Cluster faces into people, and calibrate what a similarity means

FR-CULL-9 forbids thresholding a bare cosine anywhere in the subsystem,
so calibrate fits P(same person) per library and reports whether the fit
is trustworthy. Two details carry most of the weight.

The fit runs against a 200-bin histogram rather than a pair list: a
25,000-face library has ~3e8 pairs and no gradient descent is running
over that. And a fresh library has no valid calibration, because the
positives have to come from user confirmations or burst siblings --
bootstrapping them from high cosine would fit the calibration to the
belief it was supposed to test.

Clustering defends against the over-merging FR-CULL-10 warns about with
constraints rather than a better threshold: two faces in one photograph
never merge, and two groups confirmed as different people never merge.
Average link rather than single link, so one strong edge cannot weld two
families together.

Calibration is defined once, in dr-face, and dr-catalog re-exports it.
Two implementations of one probability model is exactly how a number
comes to mean the wrong thing.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

core/dr-catalog/Cargo.toml

@@ -7,6 +7,11 @@ license.workspace = true
 
 [dependencies]
 dr-types.workspace = true
+# The face subsystem's arithmetic — `Calibration` in particular, so the sigmoid
+# that turns a cosine into a probability has exactly one definition. Default
+# features are off, so this brings in no ONNX runtime and no weights: only the
+# model-free half compiles here.
+dr-face.workspace = true
 # The `Storage` trait, and nothing else from it. A scan has to read a real
 # directory, and this is how `core/` reaches the platform without a
 # `#[cfg(target_os)]` of its own (ARCH §4.1: calls go downward).