An enrolment cannot be ended by a finger release

A three-tap enrolment declared itself complete. The transcript says why:

    frame 2: metric=308  FINGER  ev5 rem=10
    frame 3: metric=187          ev6 rem=0
    samples: 10 of 10 accepted

The release event never enters do_enroll, so its response leaves
samples-remaining untouched at 0 -- which is indistinguishable from "none
remaining, you are finished". The session believed it, stopped after one press,
and called SAVE_DATA on an algorithm holding no template. That answered -1 and
wrote nothing, so the store was undamaged, but only by luck: the guard meant to
prevent a partial save was itself satisfied by the bogus count.

A reading is only meaningful when it came from the event that runs the enrol
path, and nothing about the value says so -- the caller has to. Observe now
takes that as an argument. Two further guards: a FIRST reading of 0 is an
unpopulated field rather than a finished enrolment, and the count only ever
falls, so an increase is noise.

Verified by mutation: trusting the release event's count, and accepting a
leading zero, each fail the suite.

implementations/main.cpp

@@ -1264,7 +1264,10 @@ int Probe() {
                 // Samples remaining rides in the response on the common path,
                 // whether or not the sample was accepted -- which matters
                 // because the trustlet's log starves exactly when one is.
-                enrol.Observe(r.samplesRemaining);
+                // Only the event that runs the enrol path reports a real
+                // count. A release leaves the field at 0, which reads exactly
+                // like "finished".
+                enrol.Observe(r.samplesRemaining, ev == ta::Event::FingerTouched);
                 note += std::format("  ev{} rem={}", static_cast<unsigned>(ev),
                                     r.samplesRemaining);
             }