feat(sim): replay a directory of real images as captures (playlist pattern)

[mbreissi]

Summary

Adds frame.pattern.playlist to the sim backend (decision D-CAM-31; requested by image-processor D-IP-18): the simulator replays a directory of real image files as captures through the real finalize path — temp write, fsync, sidecar first, atomic visibility, catalog record, ImageCaptured announcement with the file's true image.bytes/image.sha256 — so downstream vision components receive genuine imagery from the real camera contract.

"frame": { "pattern": { "playlist": {
  "directory": "/srv/line-clearance/reference-images",
  "include": ["**/*.jpg", "**/*.jpeg", "**/*.png"],
  "order": "sorted", "loop": true } } }

• Deterministic: sorted walk, optional seeded shuffle (owned SplitMix64 — no dependency can reorder a seeded playlist), cursor advances once per capture, loop: false fails cleanly when spent.
• Containment is structural: canonicalized root, symlinks rejected at walk time and re-checked at capture time, per-file size ceiling, JPEG/PNG detected by magic bytes.
• JPEG members replay byte-for-byte under passthrough; other combinations decode and re-encode (PNG passthrough would need a new PixelFormat variant across all backends — recorded in the D-CAM-31 rationale).
• backendMetadata.playlist{sourcePath, index} on the terminal body / sidecar / catalog; playlist{count, index, directory} on session status.
• No new dependencies; the four synthetic patterns parse unchanged (externally tagged enum).

Docs: config.schema.json (oneOf verified against the parser), docs/reference/configuration.md, docs/how-to-guides.md ("Replay real images with the simulator"), DESIGN.md §6.2.1 + register.

Validation

• cargo test: 655 passed, 0 failed, 1 ignored (+ integration binaries ok); cargo clippy --all-targets -- -D warnings: clean.
• cargo llvm-cov --fail-under-lines 90: 92.17 % bundle; diff-cover --fail-under=95: 95 % on the diff (the #[cfg(unix)] symlink/containment tests run on the Linux runner).
• Integration test drives a capture from a temp playlist through the storage path and asserts the sidecar image.sha256 equals the replayed file's digest and that backendMetadata.playlist is present.