Add hidden-holdout carving and the leakage gate

[SheeshDarth]

What (S1 — Data & Bench, Week 2)

The hidden holdout is what we measure degradation against — if it leaks into training, every downstream result is silently inflated and GATE 0 becomes meaningless. This adds the carve and the guard.

src/ingestion/holdout.py — assigns samples by a stable blake2b hash of sample_id rather than a seeded shuffle. A sample therefore always lands on the same side of the split even as the corpus grows or gets reordered; a reshuffle would quietly move previously held-out rows into training. (blake2b, not Python's built-in hash, which is randomized per process.)

src/ingestion/check_leakage.py — two independent checks:

1. id overlap — a holdout sample_id appearing in a training file
2. text overlap — identical case/whitespace-folded text under a different id

The second matters most: once src/generation starts copying and paraphrasing text, the realistic leak is the same passage reappearing with a fresh id, which an id-only check would miss entirely. Exits 1 on leakage so it can gate CI before any fine-tune reads data.

Verification

• pytest -q → 21 passed (10 existing + 11 new)
• CLI exercised both ways on generated data: clean → exit 0, poisoned → exit 1 with a precise report naming the leaked ids

LEAKAGE DETECTED
  2 sample_id(s) shared with training data
  2 holdout text(s) reappear in training data

Note for reviewers

Independent of #1 — this branches off main and touches no normalizer code, so the two can merge in either order (both edit src/ingestion/__init__.py, so the second to merge may need a trivial rebase).

Once merged, S3's GATE-0 spike can rely on the holdout being clean.