Reject the uncalibrated text-manifest tiling and verify Content Seal transforms

Tiled diffusion was never provider-oracle calibrated with verified text
restoration: the tiled VAE donor path ran anyway and produced results no
oracle had certified. The combination is now rejected at both the
pipeline and the engine seam (ValueError with the reason), and the CLI
help no longer implies support. The invisible help is generalized and
the metadata container list corrected (MKA/OGA/Opus/AAC).

scripts/contentseal_transforms.py reproduces the deterministic crop,
resize, and JPEG variants of the Content Seal corpus from manifest.csv,
hash-verifying every output; its README gains scripts/README.md context
and new data tests. The corpus README is honest about the one crop the
daily oracle limit left unchecked, and the eval CSVs carry the updated
verdicts. The byte-scan SynthID suppression hoists its soft-binding
lookup so the guard is computed once.

Staged on top of 0.33.1; no version bump in this commit.

scripts/visible_sheets.py

@@ -12,6 +12,7 @@ Each sheet mixes three strata in shuffled order:
 The two control strata are what make a low measured precision trustworthy.
 """
 
+import argparse
 import csv
 import json
 import random
@@ -62,9 +63,13 @@ def crop(path: str, region: tuple[int, int, int, int] | None, pad_factor: float
 
 
 def main() -> None:
-    with open(sys.argv[1]) as fh:
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument("input", type=Path, help="JSON candidate list")
+    parser.add_argument("output", type=Path, help="Directory for blinded contact sheets")
+    args = parser.parse_args()
+    with args.input.open() as fh:
         items = json.load(fh)  # [{uid,path,key,stratum,conf}]
-    outdir = Path(sys.argv[2])
+    outdir = args.output
     outdir.mkdir(parents=True, exist_ok=True)
     random.Random(1234).shuffle(items)  # noqa: S311 -- sheet ordering, not cryptography