Capture works: idle floor 133, matching the reference measurement

The finger-free path is complete. On the phone, from a cold start:

    client env -> loader -> trustlet -> config -> sensor rail -> init chain
    calibrating the idle floor (5 samples)
      idle 1/5: rc=-11 metric=133
      ...
    idle floor = 133, finger threshold = 266

133 is the number the journal records for this sensor, so the port reproduces
the reference measurement rather than merely producing one.

Two things had to be right at once, and the first attempt had neither.

The memory region: CAPTURE_IMAGE reads an output-buffer pointer out of
payload+0x00, and QTEE only patches an address there if the location is named
in embeddedBufOffsets and the region handed over in an object slot. The
instrumented dump shows it working -- payload+0x00 came back holding
0x088db98000 -- which is what made the remaining failure legible instead of
mysterious.

And two fields inside the capture payload that an all-zero request leaves
unset: a frame count at +0x0c and a branch selector at +0x10. Selector 0
returns metric 0. Sending zeros gets -201 with the region correctly attached,
which reads exactly like a broken region and is not one. They are named
constants now, with the note that the metric is PER FRAME so a threshold
calibrated at one frame count means nothing at another.

The flags word at payload+0x18 stays past the declared length of 0x14 on
purpose: the trustlet range-checks that length to exactly 0x14 and reads the
flags anyway.

--verbose keeps the region and reqOut dumps, which is what turned this from
guesswork into reading.

tests/Ta/main.cpp

@@ -153,6 +153,23 @@ int main() {
     Check(CaptureFlagsOff == 0x18 && CaptureDeclaredLen == 0x14,
           "the flags word sits past the declared length on purpose");
 
+    // ---- The capture payload's two fields
+    {
+        std::vector<std::byte> cap(CaptureDeclaredLen);
+        BuildCapturePayload(cap);
+        Check(Get32(cap, CaptureFrameCountOff) == 1, "frame count defaults to 1");
+        Check(Get32(cap, CaptureSelectorOff) == 1, "selector defaults to 1");
+        Check(Get32(cap, 0) == 0, "payload+0 is left for QTEE to patch the region into");
+        // An all-zero payload is what -201 looks like on the wire.
+        std::vector<std::byte> zero(CaptureDeclaredLen, std::byte{0});
+        Check(Get32(zero, CaptureSelectorOff) == 0, "selector 0 returns metric 0");
+        // The fields must fit inside the declared length.
+        Check(CaptureSelectorOff + 4 <= CaptureDeclaredLen, "selector fits the payload");
+        Check(CaptureFrameCountOff < CaptureSelectorOff, "count precedes selector");
+        // ...while the flags word deliberately does not.
+        Check(CaptureFlagsOff >= CaptureDeclaredLen, "the flags word sits past it");
+    }
+
     // ---- SAVE_DATA masks: bit 30 is the whole discriminator
     Check((SaveMaskTemplate & (1u << 30)) != 0, "template save sets bit 30");
     Check((SaveMaskCalibration & (1u << 30)) == 0, "calibration save clears bit 30");