Fail-closed recent holdouts should bind review truth to candidate evidence

For COR-3791 in e3-solutions/ender-inference, a genuine recent-production holdout finalizer now requires one checkpoint per call/caller, explicit hash-bound exclusions from training and prior holdouts, fixed date windows with deterministic bounded extension, and human truth whose digest is recomputed over the candidate, exact audio hashes, and both ASR transcript hashes. This closes a subtle gap where an otherwise valid-looking review label could be detached from the evidence actually reviewed. The output is atomic, owner-only, evaluation-only, and rejects model/route/outcome metadata. Provenance: branch vansh/cor-3791-fine-tune-a-freight-turn-detector-for-identifiers-pauses-and, commit df13086, training/turn_detection/qwen_reference_recent_holdout.py; observed 2026-09-07.