docs: four focused findings pages (best model, gallery scope, expansion, deep dive)

Splits the rep4 write-up's key findings into their own linkable pages:
- best-model.md: calibration curves first (discriminative power, independent
  of any threshold), then F1 on the benchmark — LVFace-B Glint360K wins both.
- gallery-scope.md: whole vs. cast-restricted gallery, isolated from model and
  expansion choice — restriction wins on every axis, but isn't a shipped
  runtime feature yet.
- pose-expansion.md: the training-set expand_gallery effect, and the held-out
  replication attempt that found it doesn't reproduce (5 films, 2 models,
  after catching and fixing a replay-timeout truncation bug and a bbox
  first-match-instead-of-best-match bug in the comparison harness itself). An
  honest null result, with the methodology errors documented since they're
  exactly the kind that manufacture a false "it works!" finding.
- lvface-deep-dive.md: the winning model's held-out generalization gap, its
  two failure modes (frozen-bbox ghost tracks), and a verified case (cross-
  checked against Jellyfin's independent cast metadata) where LVFace
  correctly identified an actor that X-Ray's ground truth failed to credit.

Adds a "report-highlights" artifact-registry package (scripts/artifacts/
push_artifacts.sh, pull_artifacts.sh) for hand-picked illustrative frames that
aren't reproducible via the automated best/worst montage selection, and wires
pulling it into scripts/docs/build_site.sh.

scripts/artifacts/pull_artifacts.sh

@@ -10,6 +10,7 @@
 #   scripts/artifacts/pull_artifacts.sh galleries [version]
 #   scripts/artifacts/pull_artifacts.sh montage-frames <film-slug> [version]
 #   scripts/artifacts/pull_artifacts.sh experiment-data [version]
+#   scripts/artifacts/pull_artifacts.sh report-highlights <name> [version]
 # version defaults to "latest" (newest uploaded version, by created_at).
 set -euo pipefail
 
@@ -74,10 +75,19 @@ pull_experiment_data() {
     rm "$tmp"
 }
 
+pull_report_highlight() {
+    local version="$1" name="$2"
+    local dest="${REPO_ROOT}/docs/assets/images"
+    mkdir -p "$dest"
+    echo "=== report-highlights/${name} (version ${version}) ==="
+    curl -sf "${DL_BASE}/generic/report-highlights/${version}/${name}" -o "${dest}/${name}"
+}
+
 if [ $# -eq 0 ]; then
     echo "usage: $0 galleries [version]" >&2
     echo "       $0 montage-frames <film-slug> [version]" >&2
     echo "       $0 experiment-data [version]" >&2
+    echo "       $0 report-highlights <name> [version]" >&2
     exit 1
 fi
 
@@ -99,8 +109,14 @@ case "$TARGET" in
         [ "$VERSION" = "latest" ] && VERSION="$(resolve_latest_version experiment-data)"
         pull_experiment_data "$VERSION"
         ;;
+    report-highlights)
+        NAME="${2:?usage: $0 report-highlights <name> [version]}"
+        VERSION="${3:-latest}"
+        [ "$VERSION" = "latest" ] && VERSION="$(resolve_latest_version report-highlights)"
+        pull_report_highlight "$VERSION" "$NAME"
+        ;;
     *)
-        echo "unknown target: $TARGET (expected galleries, montage-frames, or experiment-data)" >&2
+        echo "unknown target: $TARGET (expected galleries, montage-frames, experiment-data, or report-highlights)" >&2
         exit 1
         ;;
 esac