feat(ar-024): enforce the invariant statically, and delete the fallback it caught

AR-024's register row gives its verification tier as "Static check -- no
bare cosine outside a tagged EXCEPTION". No such check existed, so the
invariant was enforced by reading, and reading had missed a live
violation.

scripts/ci/check_raw_cosine.py is that check, wired into the
traceability workflow as a blocking step. It is honest about its reach:
it catches direct cosine_similarity() uses not routed through a
calibration, and it cannot follow a cosine through a variable across
statements. That limit is documented in the script rather than left for
someone to discover after trusting a pass.

What it caught, and what this commit removes with it:

The identity matcher's no-calibration fallback thresholded raw cosine
distance (match_threshold) plus a ratio test (match_ratio,
match_ratio_ceil). Worse than the invariant breach: it fed
max(0, cosine) into TrackRegistry::observe, whose contract reads
"posterior is a calibrated probability, never a raw cosine (AR-024) ...
so the accumulation cannot be fed an uncalibrated number by a careless
caller". It could, and did. And it disagreed with the rest of the
pipeline about what "the fit failed" means -- same_person_probability
answers that with the untuned default sigmoid and a loud warning, so
association stayed in probability space while matching alone left it.
One run, two policies, no announcement.

Now one rule: cal_.probability() always, with a warning when the fit is
not real. A worse answer than a fitted calibration, a better one than a
number whose units nothing else shares.

TrackGallery::set_calibration is mandatory for the same reason. Its
default was max(0, cosine), which made expand_band_lo = 0.90 mean
"cosine > 0.9" in a test and "P(same person) > 0.9" in production.
FaceTrackerFunc already threw without one; the expansion store now
matches.

One exception is recorded, in the calibration's own dedup. It is not a
close call: at 1 - 1e-7 it asks whether two vectors are the same vector,
and it runs on the fit's input, so a calibrated comparison there would
have to be calibrated by the fit it is feeding.

Also drops seven dead keys from the optimizer's CFG_KEYS. Config keys
are read with a contains() check, so each one had been silently inert
since the field behind it was deleted -- a sweep varying one of them
measured nothing and reported an ordinary-looking F1.

TRACES: AR-024, AR-023 | SR-002

src/scene_preview.cpp

@@ -71,7 +71,6 @@ static Config parse_args(int argc, char** argv) {
         else if (arg("--verbosity"))        { int v = std::stoi(next()); cfg.verbosity = v == 2 ? Verbosity::xray : v == 1 ? Verbosity::standard : Verbosity::minimal; }
         else if (arg("--prior"))             cfg.match_prior      = std::stof(next());
         else if (arg("--prob-threshold"))   cfg.prob_threshold   = std::stof(next());
-        else if (arg("--match-threshold"))  cfg.match_threshold  = std::stof(next());
         else if (arg("--extinction"))       cfg.extinction_sec   = std::stod(next());
         else if (arg("--detector"))         cfg.detector_model   = next();
         else if (arg("--detector-engine"))  cfg.detector_engine  = next();
@@ -81,8 +80,6 @@ static Config parse_args(int argc, char** argv) {
         else if (arg("--conf"))             cfg.detector_conf    = std::stof(next());
         else if (arg("--max-faces"))        cfg.max_faces        = std::stoi(next());
         else if (arg("--min-face-px"))      cfg.min_face_px      = std::stof(next());
-        else if (arg("--ratio"))               cfg.match_ratio            = std::stof(next());
-        else if (arg("--ratio-ceil"))          cfg.match_ratio_ceil       = std::stof(next());
         else if (arg("--track-alpha"))         cfg.track_alpha            = std::stof(next());
         else if (arg("--track-min-iou"))       cfg.track_min_iou          = std::stof(next());
         else if (arg("--track-max-embed"))     cfg.track_max_embed_dist   = std::stof(next());