Coverage-first live labelling, merged catalog, shelf-intelligence decision

The live path abstained too much: a detected product whose best candidate
missed the accept line was left blank, so a shelf where 59% of in-catalog
facings were shown read as broken. Show the best candidate immediately as
`provisional`, keep the track re-classifiable so a later attempt upgrades or
corrects it, and never blank a label already on screen.

- identity.py / identity_lanes.py: every decision now carries
  `provisional_sku` - the row the evidence supports well enough to show,
  separate from `best_sku`, which still means "cleared the gate". The accept
  line does not move: far-unknown false accepts stay at 0.066%.
- live.py: a below-gate candidate labels the track with
  `identity_level: provisional` and `confirmed = False`, so the planner and
  the crop lane keep offering it. Accepted labels stay frozen. Inherited
  provisional labels stay re-classifiable.
- Clients render provisional distinctly (amber chip, dashed box) via
  `LiveScanOverlayPolicy.isProvisional(identity)`, which now reads the wire
  level instead of only the state.
- build_stock_all.py merges stock, stock-lopia, stock-mediya and
  stock-milk150 into stock-all (111 images, 60 SKUs). The server could only
  read one folder, so anything outside it came back blank. stock-demo is
  byte-identical to mediya+milk150 and is not a source.

Measured on add/image6.jpg at live resolution: in-catalog facings shown
59.4% -> 86.0%, correct shown 38 -> 55, precision 97.4% -> 87.3%. On the
wire at 8fps 0.5x: 65 of 79 tracks labelled, 742 accepted + 309 provisional
observations, first label 1.27s.

docs/research/2026-09-29-shelf-intelligence/ carries the experiments and the
decision: group signals (combined AUC 0.991 sibling / 0.990 unrelated),
OCR scheduling (group representatives cut calls 4.4x and wall 3.3x), and the
finding that group propagation damages more labels than it rescues on this
shelf, so groups schedule compute rather than overwrite labels.

331 tests pass.

recognization/code/identity_lanes.py

@@ -658,11 +658,36 @@ class DecisionPolicy:
             level = IDENTITY_REJECTED
             message = "No matching evidence"
 
+        # Coverage-first: the row the evidence supports well enough to *show*,
+        # even when it does not clear the accept line. `None` means the crop
+        # carried no usable evidence at all, which is the only case that still
+        # ends blank - a size-only read has no identity text and stays None.
+        if answer is not None:
+            provisional = answer
+        elif local and local[0][1] > 0.0:
+            # A vetoed local answer is still the best geometric guess, unless
+            # the text named a different row - then that row is the better one.
+            vetoed = bool(
+                text_top
+                and text_top[0] != local[0][0]
+                and text_top[1] > local_text_floor(text, local[0][0])
+            )
+            provisional = text_top[0] if vetoed else local[0][0]
+        elif (
+            text
+            and carries_identity(text_read or "")
+            and self._shared_evidence(text_read or "", text[0][0]) >= self.text_min_shared
+        ):
+            provisional = text[0][0]
+        else:
+            provisional = None
+
         top_score = local[0][1] if local else (text_top[1] if text_top else 0.0)
         return {
             "status": "success" if level == IDENTITY_ACCEPTED else level,
             "method": self.method,
             "best_sku": answer,
+            "provisional_sku": provisional,
             "score": round(float(top_score), 2),
             "confidence": round(float(top_score), 4),
             "identity_level": level,