Ship generator taxonomy: bytedance class, model-side receipt gate

Provider classes now name the GENERATOR that rendered the pixels, never
the brand. bytedance joins openai/google/muse-image as the shared
ByteDance lineage (Doubao and Jimeng render with one model family;
measured: separate heads cross-fire 32/22 at 3.5x mass, the surgical
union holds 83.9% on the frozen test cell while openai/google/meta/no_ai
stay byte-identical to run1). tc260 stops being a public value: its head
remains as the group veto for the rest of China's generators (without
it, 207/379 China test rows would be falsely named openai or
muse-image), and the loader tolerates provider snapshots that predate
bytedance. The receipt gate moves model-side: stable-name artifact
receipt-gate.npz carries its threshold, head and threshold always load
from one file, and the publish script stages the stable gate from the
weights source. Microsoft stays metadata-only: 144 of its 253 bank rows
name an OpenAI model as their C2PA softwareAgent and none names a
Microsoft renderer.

pre-commit: 1) maintain.sh - exit 1 (uv-secure: lightning 2.6.5 via
trustmark, PYSEC-2026-3624 no fix released; per docs/development.md the
core checks ran separately: ruff clean, pyright 0 errors, 2059 passed
3 skipped); 2) /simplify - single-pass four angles, clean, one noted
skip (gate-test npz staging duplication); 3) docs sync - grepped
bytedance/receipt-gate.npz/provider values over README, docs, skill,
rules: no stale references; 4) CLAUDE.md - improver: no changes,
revise: no additions (learnings live in canonical docs)

docs/python-api.md

@@ -218,9 +218,11 @@ print(result.label, result.detector, result.provider)
 
 `label` is `ai` only on a DEFINITELY detector result (ridge AND freeze MLP).
 POSSIBLY is `unknown`. Camera-like photographs are `human`. `provider` is
-`openai`, `google`, `muse-image`, or `tc260` only when `label` is `ai` and the 124-d
-head beats `no_ai` by the freeze margin. `tc260` is the China AIGC label
-standard (mixed producers), not a company. Otherwise it is `None`, including
+`openai`, `google`, `bytedance`, or `muse-image` only when `label` is `ai`
+and the 124-d head beats `no_ai` by the freeze margin. `bytedance` names
+the shared Doubao+Jimeng generator lineage; the rest of China's
+generators (Qwen, Kling, ...) have no honest class yet and their residual
+head abstains to `None`. Otherwise it is `None`, including
 when 124-d extraction refuses the file.
 
 `device` is a library parameter: `None` / `"auto"` detect, `"cpu"` or `"cuda"`