Run the formatter over the face branch before it reaches CI

The merge of the SCRFD/MobileFaceNet work brought 69 rustfmt diffs across
dr-catalog, dr-face and dr-ui with it, so `cargo fmt --all -- --check` fails
on master and the Desktop job stops at its Format step — before clippy, the
tests or the release build have run at all. That makes the whole desktop
half of CI blind: a real compile error behind this would look exactly the
same from the outside. There was nothing behind it, as it turns out — with
the formatting fixed, clippy, the test suite and the release build all pass.

Every .rs hunk is `cargo fmt --all` on the pinned 1.92.0 toolchain, not a
hand edit, but it is worth being precise about what that moved, because it
is more than whitespace. Besides reflowing signatures and call chains,
rustfmt reordered the `pub mod` and `pub use` items in dr-face/src/lib.rs so
the `#[cfg(feature = "inference")]` entries sort in place, added the trailing
semicolon inside `let ... else { return }` bodies in identity_ui.rs, wrapped
a bare closure body in braces in cluster.rs, adjusted trailing commas, and
dropped a stray blank line at the end of identity_ui.rs. All of it is
semantically inert; none of it changes behaviour.

docs/traceability.md rides along because it has to. The matrix records each
TRACES tag by line number, and reflowing develop.rs, lib.rs, faces.rs,
identity.rs and identity_ui.rs moved them — FR-CAT-8, FR-CAT-9, FR-CULL-10,
FR-DEV-3, FR-DEV-3a and FR-DEV-3c all shift by a line or two. The matrix was
verified up to date on d777f7f before this commit, so this is drift these
formatting changes introduced, not pre-existing staleness being swept up.
Leaving it for a follow-up commit would hand traceability-check.yml a
failure caused entirely by a whitespace change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

core/dr-face/src/embedding.rs

@@ -116,7 +116,13 @@ fn f32_to_f16_bits(x: f32) -> u16 {
         // Overflow, inf, or NaN. Embeddings are unit-norm so this is the
         // broken-model path; infinity is the honest answer, not a clamp that
         // hides it.
-        return sign | 0x7c00 | if mant != 0 && exp == 0x1f + 112 { 0x200 } else { 0 };
+        return sign
+            | 0x7c00
+            | if mant != 0 && exp == 0x1f + 112 {
+                0x200
+            } else {
+                0
+            };
     }
     if exp <= 0 {
         // Subnormal or underflow. A component of a unit 512-vector is ~0.04,
@@ -195,7 +201,11 @@ mod tests {
         let a = unit(1);
         let mut b = unit(1);
         b.model = ModelId::new("other");
-        assert_eq!(a.cosine(&b), None, "a cross-model cosine must not be a number");
+        assert_eq!(
+            a.cosine(&b),
+            None,
+            "a cross-model cosine must not be a number"
+        );
     }
 
     /// The claim docs/faces.md §6 makes about the storage format: the f16