Make InvisibleOptions engine knobs only and pin the forwarding

`InvisibleOptions` promises in its docstring that every default mirrors
`InvisibleEngine`. Two fields made that promise cost something to keep: `force` is
not an engine parameter at all, and `controlnet_scale` was a third spelling of the
engine's `controlnet_conditioning_scale`. The mirror test carried an exception
table for each. This removes both, so the comparison needs no exceptions -- a field
that needs one is a field that belongs somewhere else.

`force` decides WHETHER the engine runs, which is settled before it is built, so it
joins `backend` and `sensitivity` as a parameter of `remove_all` and `remove_batch`
and is threaded to `_run_invisible` as its own argument. `controlnet_scale` takes
the engine's own name; the click option stays `--controlnet-scale` and is now
translated exactly once instead of at three forwarding sites.

Safe to do today: both symbols landed after 0.25.0 and have never been published.

The forwarding turned out to be the weaker half. A defaults comparison cannot see a
hardcoded literal at the seam, and `_run_invisible` passed the entire suite with
`controlnet_conditioning_scale` pinned to a constant. Each of the two knobs also
reaches the engine through TWO paths -- `remove_all` versus `remove_batch(mode="all")`
for `force`, `_run_invisible` versus `_batch_engine` for the scale -- and guarding one
left the other free to hardcode with a green suite. So:

  * `test_every_field_arrives_at_the_engine_with_the_caller_s_value` drives the real
    seam with all 13 fields set off their defaults; mutating any one of them to its
    default fails it.
  * `test_force_reaches_the_scrub_gate_in_every_scrubbing_mode` and
    `test_batch_controlnet_scale_flows_to_the_cached_engine` are parametrized over
    both modes, so neither path can be pinned alone.

Also fixes an order-dependent test surfaced by the added tests reshuffling the xdist
shards. `test_visible_path_decodes_file_once` counted every `image_io.imread` in the
process, but the Gemini engine loads its own bundled capture assets on first
construction, so the count was 3 on a cold engine and 1 on a warm one and the test
passed only when an earlier test happened to build the engine first. It now counts
decodes of the SOURCE, which is the invariant it exists for, and still fails when the
shared decode is broken. The production path was never wrong: the source bitmap is
decoded exactly once.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

tests/test_identify.py

@@ -782,13 +782,19 @@ class TestIdentifyVisibleTextMarks:
         """The web path identify(check_visible=True, check_invisible=False) must
         decode the image exactly once and share the array across the sparkle +
         text-mark detectors. Two decodes of the same bitmap spiked memory on the
-        small web worker (the OOM the decode-once refactor addresses)."""
+        small web worker (the OOM the decode-once refactor addresses).
+
+        Count decodes OF THE SOURCE, not every ``imread`` in the process: the Gemini
+        engine loads its own bundled capture assets on first construction, so a
+        process-wide count was 3 on a cold engine and 1 on a warm one, and the test
+        passed only when some earlier test happened to build the engine first."""
         import remove_ai_watermarks.image_io as image_io
 
         real_imread = image_io.imread
         with patch.object(image_io, "imread", side_effect=real_imread) as mock_imread:
             identify(tmp_clean_png, check_visible=True, check_invisible=False)
-        assert mock_imread.call_count == 1
+        source_decodes = [c for c in mock_imread.call_args_list if Path(c.args[0]) == Path(tmp_clean_png)]
+        assert len(source_decodes) == 1
 
     def test_missing_pixel_extra_preserves_metadata_verdict(self, tmp_png_with_ai_metadata: Path):
         import remove_ai_watermarks.image_io as image_io