feat: expansion promotion gated on all three discontinuity signals

AR-019 — promotion may only borrow same-identity evidence from a span where
identity is certain, so every discontinuity signal now clears the buffers rather
than just the histogram cut.

is_scene_boundary was already named in the gate but never set by anything, so
that half of it was dead until AR-010 gave it a producer. It now does what the
spec always said. The third signal, an identity contradiction, needs no code
here: AR-015 closes a track whose belief swapped, so it can no longer promote.

Ownership now comes from the registry rather than a second tally. TrackGallery
was computing its own plurality vote over accepted frames, which meant two
different answers to "who is this track" could coexist in one run — and the
expansion one ignored the Bayesian accumulation entirely, weighting thirty
near-identical looks the same as thirty distinct ones. The local tally survives
only as a fallback for callers with no registry attached, which is the unit
tests and the replay harness.

Suite: 92 cases, 6133 assertions.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TRACES: AR-019, AR-010, AR-015 | SR-005

src/nodes/identity_matcher_node.hpp

@@ -144,7 +144,18 @@ struct IdentityMatcherFunc {
         // mix embeddings from two viewpoints under one buffer, so we still drop
         // every diversity buffer here — a revived track simply re-accumulates its
         // buffer from post-cut frames. Stale cross-cut embeddings are never promoted.
-        if (tf.source.is_cut) track_gallery_.clear_tracks();
+        /// TRACES: AR-019 | SR-005
+        // Promotion may only borrow same-identity evidence from a span where
+        // identity is certain, so ALL THREE discontinuity signals clear the
+        // buffers, not just the histogram cut:
+        //   is_cut            — camera-angle change
+        //   is_scene_boundary — different scene (AR-010; previously never set,
+        //                       so this half of the gate was dead)
+        // The third, an identity contradiction (AR-015), is enforced by the
+        // registry: a track whose belief swapped is closed outright, so it can
+        // no longer promote anything.
+        if (tf.source.is_cut || tf.source.is_scene_boundary)
+            track_gallery_.clear_tracks();
 
         const int n_faces = static_cast<int>(tf.embeddings.size());
         std::vector<IdentifiedActor> actors;
@@ -271,6 +282,16 @@ struct IdentityMatcherFunc {
                 registry_->observe(tf.track_ids[fi], best_actor, p, tf.embeddings[fi]);
             }
 
+            // TRACES: AR-019 | SR-005
+            // Ownership is the registry's, computed once. TrackGallery used to
+            // tally its own plurality vote over accepted frames, which meant two
+            // different answers to "who is this track" could coexist — and the
+            // expansion one ignored the Bayesian accumulation entirely.
+            if (registry_ && tf.track_ids[fi] >= 0) {
+                if (auto owner = registry_->owner(tf.track_ids[fi]))
+                    track_gallery_.set_owner(tf.track_ids[fi], *owner);
+            }
+
             track_gallery_.observe(tf.track_ids[fi], tf.embeddings[fi],
                                    best_actor, best_s, accept, tf.crops[fi]);