fix(authority): a passing verdict was self-assertable by declaring no reviewer

[jason931225]

benchmark.verdict: MEET + candidate_evidence.status: VERIFIED +
independent_outcome_review.status: HOLD validated clean. Both of the first two words are
written by the same hand that owns the capability, so a passing verdict required no second party
at all.

The controls existed and were unreachable

Everything under independent_outcome_review is rigorous: an SSH-signed review commit, canonical
registry and jurisdiction digests pinned into the receipt, a receipt path bound to the
capability and candidate, and review.reviewer_id === cap.owner refused outright.

All of it hangs off the status !== 'HOLD' branch. Leaving the review at HOLD skipped every
one of them.

A prohibition on reviewing your own work is not a control while "no reviewer" is an accepted
answer — it binds only the honest path.

Proven before the fix, against the real registers

ACCEPTED  MEET verdict, review HOLD, evidence VERIFIED
REFUSED   MEET verdict, evidence still HOLD
REFUSED   review non-HOLD without a real receipt

The two adjacent controls worked. The one joining them did not exist.

The fix

A non-HOLD benchmark verdict now requires a non-HOLD independent outcome review — which forces the
entire receipt chain that was already written and merely unreachable.

Inert today, which is why it is cheap today

All 27 capabilities are HOLD on verdict, review and evidence, so nothing about the shipped
documents changes. The test asserts the unmodified registry still validates, so "inert" is proven
rather than claimed.

The first capability to claim a passing verdict is the one that would otherwise have spent this
gap — and it would have spent it silently.

Verification

• 20/20 validator tests. The new test fails 19 pass / 1 fail with the gate disabled and
  passes restored, so it is not being satisfied by something already present.
• It pins both directions: with evidence flipped back to HOLD, the verdict must still fail on
  the older assertion — the two cannot be satisfied one at a time.
• 9/9 rebind, 1/1 train, 29/29 fanout, 4/4 route. Foundation, preflight and ADR gates pass.

Found while verifying #545, where it was recorded as pre-existing and identical on origin/main
rather than fixed inside a refactor.

No gate weakened — this adds one. No production exposure widened, no compliance claim. Every
capability, jurisdiction binding and Korea control remains HOLD.