Adopt stock's enrolment-quality config: 20 samples, and thresholds that refuse a bad one

Jorijn asked whether the sample count is ours to control and whether more
samples would help. It is -- and the config dump says something more useful.
Stock enrols with 20 samples, not the 10 we had guessed, but it also sets six
keys we were leaving entirely to the trustlet's built-in defaults:

    min_enrolling_coverage_threshold   70
    min_enrolling_quality_threshold    20
    enroll_overlap_min_area            60
    enroll_overlap_max_area            80
    enable_duplicated_finger_checking  on
    max_extral_enroll_low_quality      16

Those defaults accept anything, which is how ten quick taps in one position
became a stored template. The overlap bounds are the mechanism that matters:
a sample must overlap the previous one by 60 to 80 percent -- more means the
finger did not move, less means a gap -- so the algorithm now refuses the
same-spot sample instead of storing it. Sample count alone would have stored
twenty near-duplicates rather than ten.

Deliberately left out: min_identify_quality_threshold and
min_identify_coverage_threshold. Those gate matching rather than enrolment and
would reject exactly the landing frames the 1.5x detection threshold exists to
catch. One group of variables at a time.

fpenrol.sh grows to twenty positions, and its rejection message now says to
move rather than to press harder, because the enforcement and the guidance
finally agree on what a rejected sample means.

implementations/main.cpp

@@ -77,7 +77,7 @@ bool g_verbose = false;
 // feels. A frame costs four QTEE round trips regardless; the gap on top is
 // pure delay.
 int g_frameGapMs = 40;
-int g_samples = 10;         // common.max_enrolling_samples, as shipped
+int g_samples = 20;         // common.max_enrolling_samples, stock's value
 std::string g_logDir = "/var/log/fingerprintd";
 std::string g_stateDir = "/var/lib/fingerprintd";
 int g_rescan = -1;          // -1 = leave the config's value alone