feat(artifacts): push and pull the VR-013 corpus

The cross-source study needs two 4K recordings and a hand-sorted set of
face crops, neither of which belongs in git. Adds an xsource target to
both artifact scripts.

Push uploads the clips as-is (already compressed) and zips labelling/.
Pull fetches both and regenerates frames with ffmpeg rather than
downloading them: ~320 MB of PNG that is deterministic from the clips.
The extraction settings are pinned in the script, not left to the
caller, because the manifests key on frame filenames and on detection
order within each frame — verify_labels.py runs afterwards and fails
loudly if they drift.

Pull refuses to overwrite an existing labelling/. It is human ground
truth: somebody looked at 167 crops and placed each one, and silently
replacing that with a remote copy would destroy the expensive half of
the study.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

TRACES: VR-013

experiments/xsource/README.md

@@ -7,9 +7,29 @@ perfect, so it isolates the embedder. This one downscales the **whole frame**
 before the detector, so detection and landmark regression degrade with it.
 
 Corpus: two Pexels clips of one shoot (4096×2160, 25 fps), four people, all four
-present in both. Clips and hand-sorted crops are gitignored — push them with
-`scripts/artifacts/push_artifacts.sh`, because the sorting is human ground truth
-and expensive to redo.
+present in both.
+
+## Getting the data
+
+Clips, frames and hand-sorted crops are gitignored; they live in the artifact
+registry.
+
+    scripts/artifacts/pull_artifacts.sh xsource     # clips + labelling, frames regenerated
+    scripts/artifacts/push_artifacts.sh xsource     # after correcting labels
+
+Pulling fetches the two clips and the hand-sorted crops, then regenerates the
+frames with ffmpeg — ~320 MB of PNG that is deterministic from the clips, so it
+is not worth shipping. Extraction settings are pinned in the pull script because
+the manifests key on frame filenames *and* on detection order within each frame;
+`verify_labels.py` runs at the end and will fail loudly if they drift.
+
+Pull never overwrites an existing `labelling/`. That directory is human ground
+truth — somebody looked at all 167 crops and put each one in a folder — and it
+is the expensive part of this study, so push it once corrected.
+
+Clips are Pexels-licensed: free to use, no attribution required, but not
+CC or MIT. Fine as a frozen CI artifact on private infrastructure; do not
+redistribute them as stock content.
 
 ## Scripts