Reproducible evaluator cohorts must hash every eligibility input

Reusable evaluator-cohort invariant: the frozen source digest must include every configured field that can affect eligibility or sampling—not only the raw trace hash. Otherwise a provider/disposition metadata change can leave the cohort fingerprint unchanged. For PostgREST-backed discovery, also bind opaque keyset cursors to canonical filters, use fixed-width UTC timestamps, quote every user-derived literal, reject unknown/duplicated filter aliases, and bound client-side scans with a continuation cursor. This was observed while implementing ender-inference COR-4066 / PR #141 at 2026-09-06T20:34Z; provenance: repository commit 4118d03 and independent two-pass code review. No secrets or call content are included.