Upgrade to OpenCV 5 with frozen Hershey templates and tighten video marks

- Lock OpenCV 5 and cap NumPy below 2.4 through uv constraint-dependencies so
  PaddleX 3.7 keeps resolving; Dependabot ignores mirror the cap.
- OpenCV 5 draws Hershey putText glyphs differently, so the Dola and Kling
  video templates ship as committed OpenCV 4 renders with a recipe script, and
  the OpenArt alpha recipe now refuses any OpenCV but 4.x.
- Break Sora/Veo cross-matches in favor of Veo under valid Google AI-video
  provenance, and require the full Sora mascot shape for mascot-only matches.
- Let the Doubao engine detect marks tinted by saturated backgrounds.
- Share C2PA claim-generator, credential-level and vendor-platform helpers,
  JPEG suffixes and the DCT basis instead of per-module copies.
- Log model download failures, document the optional GITHUB_TOKEN, mark the
  photo and source classifier model cards archived, and refresh the lock.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/cli.md

@@ -393,10 +393,11 @@ remove-ai-watermarks video visible hailuo.mp4 --mark hailuo -o hailuo_clean.mp4
 remove-ai-watermarks video visible kling.mp4 --mark kling -o kling_clean.mp4
 ```
 
-The command supports the moving Sora mascot and wordmark, two Veo
+The command supports the moving Sora mascot with or without its wordmark, two Veo
 corner variants, the Seedance boxed `AI` label, the `Dola AI` text label, the
 composite `MINIMAX | hailuo AI` label, and the bottom-right Kling AI label. Sora
-searches the whole frame at multiple scales. The other detectors search bounded
+searches the whole frame at multiple scales and verifies the complete mascot
+shape when the wordmark is absent. The other detectors search bounded
 lower-frame regions with separate synthetic silhouettes. Kling additionally
 requires its bright low-saturation label near the frame edge. Every mark
 requires a spatially recurring candidate across adjacent frames. Fixed marks
@@ -407,8 +408,10 @@ provenance-aware marks; metadata alone never creates a detection.
 `--mark auto` is the default. It evaluates all providers in one decode pass and
 selects the first stable match in specificity order: Sora, Veo, Seedance,
 Doubao, Dola, Hailuo AI, then Kling AI. Their confidence scores are independently calibrated and
-are not compared across providers. Pass an explicit `--mark` to scan only that
-provider.
+are not compared across providers. Valid Google AI-video provenance resolves a
+stable Sora/Veo match in favor of Veo when their regions overlap or Veo spans
+the full clip while Sora does not; it does not create a visual detection.
+Pass an explicit `--mark` to scan only that provider.
 
 The video stream is transcoded and the complete original audio stream is
 copied without truncating an audio tail that extends beyond the final video