Authorize flows before evaluating feature cohorts
Observation (2026-09-05, source: COR-4057 implementation/review in e3-solutions/theft PR #798): evaluate flow authorization and feature eligibility before loading configuration or assigning a deterministic canary cohort. This keeps invalid or inactive requests from probing rollou…