Add paid-service captures, aggregator attribution, and provenance vetoes

Collect provider samples from Higgsfield, Runway and Dreamina plus Google
Photos, Gemini, Grok and YouTube re-encodes into data/captures/2026-09 with
a hash-checked manifest, and use them to fix attribution and false positives:

- Attribute aggregator outputs: Higgsfield job metadata, Dreamina's
  re-signed manifests, Runway's own C2PA signer, TC260 video producers.
- Veto any visible video mark when a valid C2PA claim names another vendor
  (a Gemini Omni clip read as Sora on steam), and gate Kling and Hailuo
  matches on edge, anchor and white-label evidence.
- Veto the Gemini sparkle when trusted provenance names another vendor.
- Report SynthID as present for Google Photos AI edits: Google's checker
  found it on all four measured edits, though manifests record no action.
- Add Vidu video and Wan image marks, TC260 audio placements, and record
  the AIGC key in metadata records.
- Document the research sweep, the Dreamina badge decision, and verified
  Google statements on SynthID in Photos.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/sidecar_regression.py

@@ -74,7 +74,7 @@ _LEGACY_FAMILIES: tuple[tuple[str, tuple[str, ...]], ...] = (
     ("samsung_genai", ("genaitype", "photoeditor_re_edit")),
     ("soft_binding", ("soft binding", "soft-binding", "invismark")),
     ("c2pa_cloud", ("cloud manifest",)),
-    ("hf_job", ("hf-job", "hugging face job")),
+    ("hf_job", ("hf-job", "higgsfield job", "hugging face job")),
     ("exif_generator", ("exif", "software tag", "png text")),
 )