Enforce review policy independently of optional capture steps
When a credential type requires human review, derive that hold from the current credential evidence rather than a side effect produced by an optional later capture step. Otherwise a configuration that omits that step can reach automatic approval even though the usual complete-pho…