Specify eye state as a filter term, and record what was measured

FR-CULL-13, with §3.9.1's exclusion of blink detection re-read as the
exclusion of blink selection it always was: the stored fact and the chip
are built, a pass that picks the frame where everyone's eyes are open is
not. faces.md §17 has the models, the crop measurements, the four-state
rule and its floors, the native and proxy sheets read face by face, and
what remains to measure.

docs/catalog.md

@@ -748,6 +748,19 @@ CREATE TABLE faces (
     -- (faces.md §6, §9). NULL for a face stored as a unit vector before it
     -- was kept.
     quality    REAL,
+    -- What the eyes are doing (FR-CULL-13, faces.md §17): per eye P(open),
+    -- the source pixels across its box and the sharpness of the patch the
+    -- classifier saw; and P(sunglasses). All seven or none; NULL is "never
+    -- read", which every filter treats as unknown rather than as closed.
+    -- The verdict -- open, closed, sunglasses, unclear -- is a rule in
+    -- dr_face::eyes, not a column.
+    eye_right       REAL,
+    eye_right_px    REAL,
+    eye_right_sharp REAL,
+    eye_left        REAL,
+    eye_left_px     REAL,
+    eye_left_sharp  REAL,
+    sunglasses      REAL,
     -- Which model produced this. An embedding is only comparable to others
     -- from the same model; mixing them silently yields nonsense similarities.
     model_id   TEXT NOT NULL,
@@ -895,4 +908,5 @@ and is not answered here.
 | FR-CULL-10 | §10.1 `people` and `face_person`, merge-by-redirect, §10.2 clustering as a library pass |
 | FR-CULL-11 | §5 `Selector::Person`, confirmed-only by default |
 | FR-CULL-12 | §10.1 derived data in the catalog; names to the sidecar, UUID as merge identity |
+| FR-CULL-13 | §10.1 the seven eye columns, derived like the embedding; the filter term is `RatingFilter::eyes_open` |
 | NFR-SEC-5 | §10.4 sync left undecided and off; nothing in §10 emits an embedding |