Merge the scene model: a second, ADE20K-trained graph for per-category grades

Five commits. `models/` becomes one tree at the repository root so the
weight the application carries is a single `du -sh`; the export script
stops building its multi-gigabyte venv in RAM; `yolo26s-sem-ade20k`
joins the instance model rather than replacing it; the decoder turns its
logits into a partition of unity over eight photographic categories; and
four packaging routes put the file somewhere each platform can find it.

The instance model stays exactly where it was. A semantic model merges
every pixel of a class into one region, so it cannot separate two people,
and separating two people is what clicking a subject needs. The scene tab
grades whole categories and does not care. docs/segmentation.md §16.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

# Conflicts:
#	docs/traceability.md

ui/dr-ui/src/lib.rs

@@ -73,6 +73,15 @@ pub use develop::DevelopSession;
 /// opened — see `library::shared_face_models_dir`.
 pub use library::shared_face_models_dir;
 
+/// The scene model's three files, wherever this device keeps them.
+///
+/// Public for the same reason as the directory above: the pieces that reach for
+/// a model are not all inside this crate. Exported ahead of the scene tab that
+/// will consume it so that the packaging and unpacking added alongside it have
+/// something to be verified against — `assemble-apk.sh` writing files no lookup
+/// looks for would be a silent mistake for as long as the tab took to arrive.
+pub use library::scene_model;
+
 pub mod launch;
 pub mod launch_ui;
 

ui/dr-ui/src/library.rs

@@ -3846,6 +3846,37 @@ pub fn face_models(account: &Account) -> Option<(PathBuf, PathBuf)> {
         .or_else(|| system_face_models_dirs().into_iter().find_map(pair))
 }
 
+/// The scene model, its vocabulary and its category descriptor, if all three
+/// are present.
+///
+/// All three or none, for the same reason `face_models` insists on its pair:
+/// the graph alone decodes to 150 anonymous channels, and a descriptor naming
+/// classes a different model does not have is refused by
+/// `dr_segment::scene::parse_categories` anyway. Reporting the set missing is
+/// more useful than starting and failing at the first inference.
+///
+/// Searched in the same three places, most specific first — the account's own
+/// directory, the shared one, then wherever a package installed them. Android
+/// only ever finds the second, which is where `install_bundled_models` unpacks
+/// the APK's copy before any store opens.
+///
+/// Unlike the face weights this model *is* in the repository, so a desktop
+/// build from a complete checkout has it. Absent means either a checkout
+/// without `git lfs pull` or a package that chose not to carry 24 MB, and the
+/// scene tab reports itself unavailable rather than the app refusing to run.
+pub fn scene_model(account: &Account) -> Option<(PathBuf, PathBuf, PathBuf)> {
+    fn set(dir: PathBuf) -> Option<(PathBuf, PathBuf, PathBuf)> {
+        let model = dir.join("yolo26s-sem-ade20k.onnx");
+        let classes = dir.join("yolo26s-sem-ade20k.classes.json");
+        let categories = dir.join("categories.txt");
+        (model.is_file() && classes.is_file() && categories.is_file())
+            .then_some((model, classes, categories))
+    }
+    set(face_models_dir(account))
+        .or_else(|| set(shared_face_models_dir()))
+        .or_else(|| system_face_models_dirs().into_iter().find_map(set))
+}
+
 /// Where a *package* may have installed the models.
 ///
 /// `$XDG_DATA_DIRS` rather than a hard-coded `/usr/share`, because that is the