feat: banded admission for the per-subject embedding store

AR-018 — an embedding joins a track's store only if its similarity to something
already there falls inside a band, rather than merely being far from the gallery.

Above the upper bound it is redundant: another look at a pose the store already
covers, teaching the annex nothing while costing a slot a novel view could have
used. Below the lower bound it is suspect: within one track every face is the
same person by construction, so an embedding unlike everything else on the track
is evidence that construction failed — a track-ID collision or a bad detection.
Admitting it is exactly how an actor's annex gets poisoned with someone else's
face.

The old gate had only the upper half of that idea, expressed as a raw cosine
against the gallery. Both bounds are now calibrated probabilities (AR-024), so
the same number means the same thing here as in association and evidence
weighting rather than three different things.

This catches track-ID collisions EARLIER than the spread gate did — at the door
rather than at promotion — so the buffer never becomes two-person in the first
place. The spread gate stays as a second line for a track that drifts gradually
instead of jumping. The existing test was asserting the mechanism rather than
the outcome, so it was rewritten to assert what actually matters: whichever gate
fires, the outsider must not reach the annex.

Rejections are counted. A store that admits nothing is as broken as one that
admits everything, and neither is visible otherwise.

Band defaults 0.90-0.95 are working values pending VR-007; the two bounds fail in
opposite directions and must be swept separately.

Suite: 92 cases, 6133 assertions.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TRACES: AR-018, AR-024 | SR-005

src/config.hpp

@@ -149,6 +149,15 @@ struct Config {
     // opposite of the earlier assumption that it only helps restricted galleries.
     bool   expand_gallery{true};         // master switch
     int    expand_buffer_size{20};       // per-track diversity buffer capacity
+    // TRACES: AR-018, AR-024 | SR-005
+    // Banded admission for the per-subject store, in PROBABILITY space. An
+    // embedding joins only if P(same person) against something already stored
+    // lands inside [lo, hi]: above hi it is redundant, below lo it is evidence
+    // the track is not one person. Replaces expand_novelty_sim, a raw cosine.
+    // Working values pending VR-007; sweep both bounds, they fail in opposite
+    // directions.
+    float  expand_band_lo{0.90f};
+    float  expand_band_hi{0.95f};
     float  expand_novelty_sim{0.55f};    // promote only embeddings whose best sim to the
                                          //   actor's refs is below this (gallery-far / novel)
     float  expand_track_spread_max{0.60f}; // reject promotion if the retained buffer's