Use fixed Pets model Release and idle-start recognition

[OliverZhaohaibin]

Summary

This PR replaces production-side DINOv2 source execution and user-side tracing
with one fixed project Release artifact, makes both Pets model acquisitions
self-healing and permission-safe, and intentionally starts People/Pets after a
successful startup metadata scan plus 1500 ms of application inactivity.

Runtime model contract

• Production downloads only pet-models-v1/dinov2_vits14.pt; it never invokes
  Torch Hub, downloads DINO source/checkpoint, imports xFormers, or traces a
  model on the user's machine.
• Manifest v2 pins Release URL, SHA-256, exact size, cache schema, DINO source
  commit/tree, official checkpoint, and torch==2.12.1 producer contract.
• IPHOTO_PET_MODEL_DIR is authoritative for lookup and repair. Corrupt YOLOX
  and legacy/invalid DINO caches are repaired in place under a cross-process
  acquisition lock; disabled downloads preserve the invalid file and fail
  explicitly. Only EACCES, EPERM, and EROFS can trigger storage fallback.
• Candidate run, build manifest, Release tag and Release target now share
  builder commit ceb24fa011faa78928e4fb93426273c9f64a9358.
  The public model is pinned at SHA-256
  7f8e204c6222662ee53ef61fb02b1278781e0ab70a57fa73a63cdef9ed32ab13
  and 88,566,102 bytes.
• Publishing is separated from candidate validation. The protected publish
  workflow requires an artifact run ID, verifies the run API/workflow/repository,
  builder checkout and build manifest, targets the artifact head SHA, and
  refuses to overwrite the now-frozen v1 Release.

Intentional recognition startup policy

After startup metadata succeeds, input inactivity arms a 1500 ms timer and
starts closed-input Face/Pet workers at LowestPriority. Click, wheel, key,
drag, touch, gesture, owned menus, modal dialogs and transient popups reset the
timer. Rebind, cancellation, scan failure and shutdown invalidate it.

Opening People while the metadata scan is active no longer starts workers early.
cv2 process-global initialization is serialized before a Face QThread starts,
preventing the observed macOS libshiboken KeyError: cv2.Error fatal exit.

The same-commit benchmark switch
IPHOTO_STARTUP_RECOGNITION_AUTO_START=0 disables only automatic startup for
controlled A/B; explicit feature activation remains available.

Performance evidence

See
PR917_RECOGNITION_IDLE_BENCHMARK.md.

• Two 30-sample auto batches, two 30-sample feature-scoped batches, and an
  alternating 10-pair A/B used a disposable five-image template restored before
  every run.
• Alternating A/B showed no first-frame/gallery regression: first gallery
  P50/P95 -0.09%/-0.63%; first usable thumbnail -0.06%/-2.77%.
• Post-recognition GUI job stall was 0 ms in all 30 auto samples.
• Auto +5 s resource envelope: CPU P50/P95 8510/8786 ms, RSS P50/P95
  1395/1469 MiB on macOS arm64 source runtime.
• Quick-close: 30/30, no recognition worker start or late-QThread/fatal
  diagnostics. Missing Pets model/download-disabled: 5/5 graceful runs.
• 50k production-shape remains covered on Linux/macOS/Windows by the dedicated
  contract. Packaged Windows/Linux/macOS Intel resource figures remain manual.

Validation

• Local full suite: 3233 passed, 21 skipped.
• DINO candidate: pinned source/checkpoint, eager↔TorchScript equivalence, and
  identical artifact loading on Ubuntu, macOS and Windows.
• Public Release contract downloads the real GitHub asset through the production
  TLS/hash/size path and performs jit.load plus fixed-shape inference.
• Main workflow covers full tests, three-platform startup, GPU/detail/cache,
  YOLOX, Pets 50k, and 384-dimensional production-shape contracts.