Authenticate: one matcher run per frame, on a settled image

Two changes to the verify loop, both from measurement on the daemon.

The rising edge sent events 5 and 7 from the same capture and got two verdicts
back from one image -- rej rej, -11 -11, MATCH MATCH. Event 5 reaches the
matcher here as well as event 7, so the second REPORT_EVENT was 250 to 300 ms
of redundant work on every press, on the frame where speed matters most.
Authentication now sends only event 7. Enrolment keeps event 5, where it is the
sample trigger rather than a duplicate.

And the frame that detects the finger is the finger landing: partial contact,
and the frame that rejects most often -- across the real runs matches came at
frame 3, 5 and 8 of a press, and a quick tap is one frame. So on the rising
edge the daemon captures once more, about 50 ms later, before reporting, and
the matcher's first look is at a settled finger.

The rescan-budget experiment is reverted. At the stock budget every
non-matching frame answered -11, for the enrolled finger and the wrong one
alike, while matches landed exactly where they did at rescan=0. The budget
relabels a non-match; it does not make the trustlet try harder. Under the press
rule the two are functionally identical, and rescan=0's terminal rejection is
the cleaner label.

tests/Engine/main.cpp

@@ -115,11 +115,14 @@ int main() {
         auto e4 = t.Observe(false, Mode::Enrol);
         Check(e4.empty(), "enrol: idle reports nothing");
 
-        // Authentication: every frame with a finger reaches the matcher.
+        // Authentication: every frame with a finger reaches the matcher, ONCE.
+        // Event 5 also runs the matcher here, so sending it on the rising edge
+        // produced two verdicts from one image and cost ~300 ms extra on the
+        // frame where speed matters most.
         TouchTracker a;
         auto a1 = a.Observe(true, Mode::Authenticate);
-        Check(a1.size() == 2 && a1[0] == Event::FingerTouched && a1[1] == Event::ImageReady,
-              "auth: rising edge reports touched then image-ready");
+        Check(a1.size() == 1 && a1[0] == Event::ImageReady,
+              "auth: rising edge reports image-ready only -- one matcher run, not two");
         auto a2 = a.Observe(true, Mode::Authenticate);
         Check(a2.size() == 1 && a2[0] == Event::ImageReady, "auth: a held frame still reports image-ready");
         auto a3 = a.Observe(false, Mode::Authenticate);