feat(transforms): add upscayl super-resolution variants

[szmyty]

Summary

Adds Upscayl-NCNN as a first-class local image super-resolution provider and introduces generic provider-variant identity/evidence so model selection can participate in Renderflow planning, provenance, and toolchain/cache fingerprints.

This implements #373 without creating a parallel image-only planner. The pure variant-selection API is designed for the canonical planner/executor work in #354 to consume.

Provider and model catalog

• Registers tool.upscayl-ncnn with capability image.super_resolution.
• Discovers upscayl-ncnn and packaged upscayl-bin executables through the existing bounded tool probe path.
• Adds a canonical seven-model catalog: Standard, Lite, High Fidelity, Remacri, Ultramix Balanced, Ultrasharp, and Digital Art.
• Records stable variant IDs, native scale, and publication-relevant commercial-use metadata.
• Keeps custom .param / .bin models runtime-discovered rather than silently promoting them to built-ins.
• Computes deterministic SHA-256 material evidence for model files when available.

Execution and diagnostics

• Adds a bounded UpscaylAdapter built on the existing ProcessExecutor from Centralize and harden external tool execution with bounded process policies #356.
• Executes with network denied, explicit timeout, direct argv, and required non-empty output validation.
• Captures provider/capability/variant/model digest, executable identity/checksum when resolvable, native/requested/post scale, GPU selection, backend evidence, output format, compression, tile size, and TTA configuration.
• Separates executable availability, model-material readiness, and Vulkan/GPU readiness.
• Provides actionable missing-executable, missing-model, missing/unverified-Vulkan, and provider-unavailable states.
• Provides an ignored real-GPU smoke test that uses the production adapter path.

Generic variant architecture

• Extends transform graph edges with optional stable variant_id and deterministic evidence maps.
• Preserves provider/capability/variant/evidence into ExecutionPlan edges and waves.
• Adds SelectedToolVariantEvidence to selected-provider toolchain snapshots.
• Makes selected variant evidence participate in the toolchain fingerprint, so model checksum/configuration changes invalidate compatible cache identity.
• Adds generic spec-v2 selectors: target.variant, include.variants, and exclude.variants.
• Adds pure select_upscayl_variants(spec, catalog) intent resolution for exact, subset, profile, and all_reachable selection.

Policy and publication behavior

Upscayl is local AI super-resolution, so v2 policy remains explicit:

• execution.ai: deny blocks selection; local_only / allow opt in.
• tool allow/deny policy is respected.
• deterministic: true rejects Upscayl because GPU/Vulkan implementations should not be assumed bit-for-bit portable.
• native x4 model scale is recorded separately from requested/post-processing x1/x2/x3 scale.

The model catalog does not assume every bundled model has identical publication rights. Remacri, Ultramix Balanced, and Ultrasharp are recorded as currently labeled Non-Commercial by Upscayl; other bundled models remain unknown unless separately verified.

CLI and docs

Adds a generic variant-inspection surface:

renderflow tools variants tool.upscayl-ncnn
renderflow tools variants tool.upscayl-ncnn --models-dir /path/to/models
renderflow tools variants tool.upscayl-ncnn --models-dir /path/to/models --format json

Also adds the super-resolution guide, generated Upscayl model reference, generated tool-registry integration, v2 schema/reference updates, docs drift checks, and the documented opt-in real-GPU smoke command.

Tests

GPU-free coverage includes stable catalog identity, non-commercial metadata, custom model checksums, exhaustive/exact/subset/exclusion selection, AI policy denial, missing executable/model readiness, fake Vulkan readiness, scale evidence, compression validation, variant-sensitive toolchain fingerprints, and provider/model evidence surviving into ExecutionPlan.

Boundary with #354

This PR does not add a second image-specific execution planner. It establishes the provider/model runtime, generic variant identity, selection API, provenance, and fingerprints that #354 can project into the canonical unified execution plan.

Final validation

Final review commit: 9bfc03adac05810b7890332e692ae3cd6ab19bea — one Conventional Commit.

All PR-triggered workflows passed on that exact SHA:

• CI 33508473754 — success
  • Clippy with warnings denied
  • full Rust workspace build and tests
  • web format/lint/typecheck/tests/build
  • portable installer smoke test
  • Arch stable + git PKGBUILD validation
  • Snap build/install/version smoke + artifact upload
  • bundled hello-world/transforms dry-runs
  • library embedding + plugin registration examples
• docs 33508473822 — success
  • tool registry + Upscayl model reference regeneration
  • runtime v2 JSON Schema/reference regeneration
  • generated-artifact zero-diff verification
  • strict MkDocs build
  • versioned docs build smoke test
• Commit Lint 33508474061 — success

Closes #373