Traceability: vendor the shared gate, annotate the source

Adds jray-project as a submodule at scripts/vendor/jray-project, so this repo
runs the same extractor as every other component rather than its own copy, and
gains the system spec that defines the PR/SR requirements its register traces
up to.

scripts/traceability-gate.sh is a thin wrapper holding only what is specific to
this repo: UR/DR prefixes, .rs sources, and REPO_ROOT — which the shared gate
cannot infer once vendored, since its default resolves to the submodule itself.
Each override fails silently in a way that looks like "no work done" rather
than "misconfigured", so the wrapper documents why each is needed.

Annotates 35 units with TRACES tags, on the code that decides rather than every
helper it calls. Coverage is 23/32 (71.9%) with no orphan tags. The nine
untraced are genuinely unimplemented: UR-007 is plugin-side, UR-008 is
federation, and UR-015..018 are the pending SR-003 schema bump.

The gate caught a real error in the first pass: several tags separated IDs of
different types with commas. A comma joins IDs within one type; a pipe
separates types. Fixed, and the diagnostics are now clean.

MIN_COVERAGE stays 0 deliberately. The gate still fails on orphan tags, a >100%
ratio, a register parsing to nothing, or an empty source scan — raise the
threshold as a ratchet once the remaining work lands.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

src/validate.rs

@@ -75,6 +75,7 @@ pub struct ActorScenes {
 /// than dodging it: pipeline timings are *derived* by accumulating `1/fps`, so
 /// they carry accumulated error, and any value near a rounding boundary would
 /// otherwise hash differently on two servers.
+/// TRACES: DR-011 | SR-003
 pub fn to_centiseconds(secs: f64) -> i64 {
     (secs * 100.0).round() as i64
 }
@@ -108,6 +109,7 @@ fn is_tmdb_id(s: &str) -> bool {
 ///
 /// No digits and no `/ + =`, which is what **defeats base64/hex smuggling**. No
 /// control characters, and no zero-width or bidi-control codepoints.
+/// TRACES: UR-011 | SR-004
 fn is_allowed_text_char(c: char) -> bool {
     if matches!(c, '.' | '\'' | '-' | ',' | ' ') {
         return true;
@@ -198,6 +200,7 @@ fn check_not_path_shaped(field: &str, value: &str) -> VResult<()> {
 // Manifest validation
 // ---------------------------------------------------------------------------
 
+/// TRACES: UR-003, UR-014 | SR-003, SR-004
 pub fn validate_manifest(mut m: Jmanifest) -> VResult<ValidManifest> {
     if m.jmanifest_version != JMANIFEST_VERSION {
         return Err(err(
@@ -348,6 +351,7 @@ fn validate_video_hash(h: &str) -> VResult<()> {
 ///
 /// `runtime_sec` is needed because §3 shortens the window for very short items;
 /// see [`expected_min_frames`].
+/// TRACES: UR-009, UR-011 | SR-003, SR-004
 pub fn validate_audio_signature(sig: &str, runtime_sec: f64) -> VResult<()> {
     // IR-007: media shorter than the window emits **no signature**, and no sync
     // offset is applied to it. A signature present on such an item did not come
@@ -479,6 +483,7 @@ fn validate_actors(m: &Jmanifest) -> VResult<Vec<ActorScenes>> {
     Ok(out)
 }
 
+/// TRACES: UR-013 | SR-002
 fn validate_scenes(idx: usize, a: &Actor, runtime_sec: f64) -> VResult<Vec<(i64, i64)>> {
     if a.scenes.len() > limits::MAX_SCENES_PER_ACTOR {
         return Err(err(
@@ -532,6 +537,7 @@ fn validate_scenes(idx: usize, a: &Actor, runtime_sec: f64) -> VResult<Vec<(i64,
 /// episodes are reported in the per-episode results list — the bundle is not
 /// atomic, because all-or-nothing would let one bad episode discard an entire
 /// season's compute (§2).
+/// TRACES: UR-006 | PR-006
 pub fn validate_bundle_envelope(b: &SeriesBundle) -> VResult<()> {
     if b.jmanifest_version != JMANIFEST_VERSION {
         return Err(err(