Make locative recall prove identity, not overlap (V-719)

The spare-key note scored 0.832 to 0.867 against a spare passport, a blue
shirt, a blue document box and a car key. Score and margin cannot separate
those: the right note runs 0.817 to 0.892 and the silent cases 0.787 to
0.874, so the ranges overlap and structure has to decide.

RecallAllowed now takes two structural facts from the router. A locative
question must corroborate every identity term against the candidate's
subject, read up to its first dictionary-proven verb, so a location object
in the note cannot answer for the thing being located. A turn that is not
question-shaped needs a named shared topic even when it ends in '?', which
is what "я отменил напоминание про молоко" lacked when it recalled an
unrelated note at 0.825 with no runner-up to fail the margin.

query_min_score moves 0.55 to 0.80 for tokenizer rev 2. The held-out
fixture answers 14/27 real recalls and 0/14 false ones.

LocativeAnswerVerifier is the resident-model second opinion, kept behind
the deterministic gate and wired into nothing. The measurement that says
why is docs/evals/2026-08-15-locative-answerability-verifier.md.

--no-verify: master is the working branch this session by the owner's call.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

internal/config/deployconfig_test.go

@@ -52,6 +52,14 @@ func TestDeployConfigLoads(t *testing.T) {
 	if cfg.Voice.RouterThreshold <= 0 {
 		t.Error("router threshold did not get its default")
 	}
+	// The recall thresholds are a measured pair. An explicit deployment value
+	// silently overriding a retuned default would make the eval and the box run
+	// different safety gates, so pin both directions here.
+	if cfg.Voice.QueryMinScore != DefaultQueryMinScore || cfg.Voice.QueryMinMargin != DefaultQueryMinMargin {
+		t.Errorf("deploy recall gate is %.3f/%.3f, defaults are %.3f/%.3f",
+			cfg.Voice.QueryMinScore, cfg.Voice.QueryMinMargin,
+			DefaultQueryMinScore, DefaultQueryMinMargin)
+	}
 
 	// The second reach (V-649). The token is a ${VAR} that CI cannot resolve, so
 	// the committed deployment makes the dark state explicit. Removing disabled