Add CLI calibration and automation for beta.18

[rohanpandula]

Adds CLI calibration and recoverable automation after beta.17. A headless session can save without scanning, solve and lock RGB exposure, repeat labeled captures, verify receipt-bound artifacts, and collect immutable copies. Held-worker film status uses the existing USB reservation. Each held capture round has unique parent/worker paths; repeated passes wait for idle and retain exact job markers.

Adds retained-master render/export, metadata on private copies, HTML reports, declarative jobs, diagnostics, evidence ZIPs, bounded waits and hooks, observer recovery, controller labels, host-scoped idempotency, and a managed LaunchAgent. Existing output destinations provide automatic per-frame delivery. Hopper mode reuses roll execution and waits for absent-to-present film transitions. Archive/positive/preview destinations stay under the project; raw exports may use an external destination.

Preview-derived exposure is experimental and off by default: one median preview reference is metered, positive-only RGB adjustments are capped at 1 EV/device bounds, IR remains metered, and receipt provenance is validated against the durable reference lock. Missing/ambiguous evidence and incompatible frame geometry are refused before metering. Reuses existing observed-boundary registration; removed a redundant correction that would shift registered frames twice.

Validation: constituent Rust coverage totals 706 passed and 2 existing ignored after fixing the active-preview status deadline regression. Swift full suite passed 920 tests; the subsequent geometry guard passed 68 focused tests. Bridge full run had 438 passes and one outdated test-double signature; the corrected signature and authority tests passed the focused rerun. Real held-worker loader/path regressions passed in canonical and vendor trees. CLI11 (043c6a5, 0.7.0-beta.17-cli.11) passed packaging, relocation/launcher checks, strict deep signature verification, and all three packaged CLI selftest scenarios (stall, feed-jam and reattachment). Simulator AUTO12 correctly refuses missing measured evidence; it cannot establish successful hardware exposure authority.

Hardware evidence: CLI9 completed a real LS-5000 ED/SA-30 preview, exposure solve and one 4000 dpi/16-bit RGBI/1x frame2 capture (Held01). RGB ticks were [137373,337050,375487]; all 189194240 capture bytes arrived. Receipt-bound verification passed, but no-clipping verification failed on actual measured clipping. A second held round refused stale journal identity, motivating the new per-round parent/worker paths. Originals remain untouched. The corrected TIFF reader successfully collected the retained real Held01 RGB/IR/meter/receipt into a fresh destination with matching hashes.

Release authorization: the owner explicitly chose to ship this beta before the remaining attended hardware checks and have an external tester validate it. No further film loading or hardware test blocks publication. Preview-derived exposure remains off by default. Release notes for v0.7.0-beta.18 label repeated hardware capture, preview-derived exposure and calibration quality unverified.

CLI11 passed package/signature verification and all three packaged selftest scenarios. All eight CI gates pass for043c6a5. The release preparation bumps the bundled driver to the matching published CoolscanPy0.7.10, pins its authenticated sdist and the same eight reviewed app-specific differences, and adds tag-bound beta.18 notes. The tag workflow performs final verification, signing, notarization and publication.