Grow the sequential test set from annotator imports, append-only

[Chouffe]

What

Annotator imports can now assign sequences to all three splits (80/10/10), and sequential_test becomes append-only: every release's test set is a byte-identical superset of the previous one, so a model trained on an earlier dataset release stays comparable with one trained on a later release (re-evaluate the old model on the grown test set, or on the frozen old subset inside it).

Design: docs/specs/2026-08-14-annotator-test-growth-design.md (supersedes the deferred test-growth item and §4 of the 2026-08-13 import design).

Why the lockfile

The built test set was never a copy of the test split — it is a KMeans selection recomputed on every build. One new WF test sequence changes k and silently re-rolls all 151 historical negatives; test has only been stable because no dep of the stage changed. This PR replaces that accident with recorded state:

• data/raw/sequential_test_lock.json — ordered, append-only, git-committed list of FP folders that is the FP half of sequential_test. Bootstrapped from the shipped test set (never recomputed), verified byte-identical through a full rebuild.
• scripts/freeze_test_selection.py — manual command (same state-boundary rationale as plan_annotator_import.py): pins annotator test FPs up to quota in registry order, fills remaining slots via the existing two-stage selection, never removes or reorders.
• build_sequential_dataset.py does no selection for test: it copies the lockfile verbatim and hard-errors on any mismatch (stale quota, unregistered folder, missing on disk).

Also in here

• assignments_from_splits / add_data.py accept pre-assigned test splits; SPLIT_TARGETS opens to 80/10/10 (greedy deficit — expect the first ~15–20 new assignments to catch up into test).
• Same-fire guard: new smoke alerts on one (camera, azimuth) view chaining within --same-fire-window (12 h, transitive) share one split, inheriting from previously planned smoke — a fire can no longer straddle train and test.
• Leakage suite gains ledger split-pinning and lockfile↔quota consistency checks.
• dvc.yaml: the build stage depends on the lockfile instead of the test embeddings, so test-embedding churn no longer rebuilds sequential_test.
• Import workflow gains one step: plan → materialise → add_data ×2 → freeze_test_selection.py → dvc repro.

The detector's yolo_test deliberately keeps its current behaviour (see Non-goals in the spec).

This branch also carries the #35 recurring-object FP identity spec + plan (docs only).

Verification

• 180 tests pass (uv run pytest tests/), including new suites for the lockfile, freeze command, same-fire grouping, and build errors.
• Bootstrap fidelity: lockfile == shipped sequential_test/test/fp (151 folders), and dvc repro build_sequential_dataset reproduces the test split byte-for-byte (folder-list diff empty for both WF and FP).