feat: provenance attributes on the embedding dump

VR-010 — a dump made with one detector/embedder pair was byte-indistinguishable
from one made with another, except for the two attributes GR-004 added. Replayed
against a gallery from a different model, cosine similarities are meaningless
but look entirely plausible. The register states the principle directly: a
fixture whose provenance is unknown is worse than no fixture, because it will be
trusted.

Sixteen attributes now record everything that determines the dump's content:
detector model and thresholds, min_face_px, max_faces, cut_threshold,
dense_scale, bbox_upscale, start/end, track_assoc_min_prob, and scene_detect.

scene_detect is the one that matters most. is_scene_boundary is all-zero both
when the detector found nothing and when it never ran, and those mean completely
different things to a consumer — without the flag they are indistinguishable.

No schema_version bump: new root attributes are additive and replay.py already
reads attributes with a default, so older dumps stay readable and the committed
fixtures — which predate this — still load.

Also corrects SCHEMA.md, which claimed bbox was already mapped to original
resolution at dump time. It is not; the upscale is applied downstream in the
matcher, after the dump tap. Harmless while dense_scale is 1 and silently wrong
otherwise, so bbox_upscale is now recorded and the doc says what the code does.

Verified end to end: all sixteen attributes present and correct on a freshly
generated dump.

Suite: 92 cases, 6136 assertions.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TRACES: VR-010, VR-001 | PR-002

docs/SPEC.md

@@ -1360,9 +1360,11 @@ Persist pipeline state at the point where the expensive work ends.
   variable-length HDF5 types and reads straight into numpy.
 - Stores per frame: `timestamp_sec`, `frame_idx`, `is_cut`, `is_scene_boundary`.
   Per face: `embedding` [N,512], `bbox` [N,4], `landmarks` [N,10], `confidence`.
-- Invariants: embeddings unit-norm; `face_offset` contiguous; bboxes already in
-  original resolution; frames with no faces still get a row so timestamps stay
-  dense; EOF sentinels not written.
+- Invariants: embeddings unit-norm; `face_offset` contiguous; bboxes and
+  landmarks in **decoded-frame** pixels with `bbox_upscale` recorded alongside
+  (the dump is a faithful tap, so it does not transform what the tracker saw —
+  see VR-010); frames with no faces still get a row so timestamps stay dense;
+  EOF sentinels not written.
 - Enabled by `--dump-embeddings out.h5`; teeing must not perturb the live result.
 
 Schema owned by [`scripts/optimizer/SCHEMA.md`](../scripts/optimizer/SCHEMA.md).