Capture works: idle floor 133, matching the reference measurement

The finger-free path is complete. On the phone, from a cold start:

    client env -> loader -> trustlet -> config -> sensor rail -> init chain
    calibrating the idle floor (5 samples)
      idle 1/5: rc=-11 metric=133
      ...
    idle floor = 133, finger threshold = 266

133 is the number the journal records for this sensor, so the port reproduces
the reference measurement rather than merely producing one.

Two things had to be right at once, and the first attempt had neither.

The memory region: CAPTURE_IMAGE reads an output-buffer pointer out of
payload+0x00, and QTEE only patches an address there if the location is named
in embeddedBufOffsets and the region handed over in an object slot. The
instrumented dump shows it working -- payload+0x00 came back holding
0x088db98000 -- which is what made the remaining failure legible instead of
mysterious.

And two fields inside the capture payload that an all-zero request leaves
unset: a frame count at +0x0c and a branch selector at +0x10. Selector 0
returns metric 0. Sending zeros gets -201 with the region correctly attached,
which reads exactly like a broken region and is not one. They are named
constants now, with the note that the metric is PER FRAME so a threshold
calibrated at one frame count means nothing at another.

The flags word at payload+0x18 stays past the declared length of 0x14 on
purpose: the trustlet range-checks that length to exactly 0x14 and reads the
flags anyway.

--verbose keeps the region and reqOut dumps, which is what turned this from
guesswork into reading.

interfaces/Fingerprintd-Ta.cppm

@@ -173,6 +173,28 @@ export namespace fingerprintd::ta {
     // is written past the declared length on purpose. 0x20 gives -201.
     inline constexpr std::uint32_t CaptureDeclaredLen = 0x14;
 
+    // Two fields inside that payload which an all-zero request leaves unset.
+    //
+    //   +0x0c  frame count      how many frames this capture takes
+    //   +0x10  branch selector  which capture path runs; 0 returns metric 0
+    //
+    // Both matter for reading the result as much as for getting one: the
+    // metric is PER FRAME, so a count of 4 reads roughly four times a count of
+    // 1 and a threshold calibrated at one count is meaningless at another.
+    // Sending zeros gets -201.
+    inline constexpr std::size_t CaptureFrameCountOff = 0x0c;
+    inline constexpr std::size_t CaptureSelectorOff = 0x10;
+    inline constexpr std::uint32_t CaptureFrameCountDefault = 1;
+    inline constexpr std::uint32_t CaptureSelectorDefault = 1;
+
+    inline void BuildCapturePayload(std::span<std::byte> out,
+                                    std::uint32_t frames = CaptureFrameCountDefault,
+                                    std::uint32_t selector = CaptureSelectorDefault) {
+        std::ranges::fill(out.first(CaptureDeclaredLen), std::byte{0});
+        detail::StoreU32(out, CaptureFrameCountOff, frames);
+        detail::StoreU32(out, CaptureSelectorOff, selector);
+    }
+
     // ---- SAVE_DATA --------------------------------------------------------
     //
     // payload+0x00 is a bitmask and the handler's first test is