Tesserocr flip conditions (pre-OCR_ENGINE-switch fixes, land in the bump PR)

[WilfordGrimley]

Tron gate findings on PR #486 (2026-07-25) that BLOCK flipping OCR_ENGINE=tesserocr — to be fixed inside the version-bump PR (the flip's own venue), not #486:

1. MEDIUM: _tesserocr_available catches only ImportError — a broken shared-lib link raises OSError/RuntimeError uncaught. Widen to Exception.
2. MEDIUM: TSV read+parse (GetTSVText + _tesserocr_tsv_to_dict) runs outside the crash-guarded region — malformed row raises ValueError to PROTECTED-CORE-adjacent callers. Guard it.
3. MEDIUM: _tesserocr_api is a process-global PyTessBaseAPI with no lock; safe under today's single-threaded-per-process OCR but silently cross-contaminates under any future threaded caller. Lock it or document the invariant with an assertion.
   LOW (fix opportunistically): 12-field TSV row padding difference; override_settings used in ocr_engine_ab production code; tesserocr absent from requirements.txt so the real-engine fidelity test skips in CI (flip evidence rests on the image build + a live ocr_engine_ab run).
   Also from the same gate, Add Stage C evidence transfer, decoupled fetch-ahead, and echo suppression #484 LOW: models.py:1978 + persist_evidence docstring mislocate the interim guard (it lives in the two calculator loops, not _eligible_cards_queryset) — comment fix, fold in wherever convenient.
   Runbook note (binding, also on md5 identity groups: checksum substrate, evidence transfer, and group-level vote pooling #473): after Add artbox_phash Stage C extractor (evidence-only) #485 merges, transfers return 0 until the pass repopulates the 12-key manifest — fail-closed by design, NOT a md5 identity groups: checksum substrate, evidence transfer, and group-level vote pooling #473 bug; intra-pass transfers resume as the pass stamps full manifests.