feat(brand): a shot can take a body, so the last hand-made stills are generated

Three pictures on /arena — the chase camera behind the EV, the crow in flight, the
aircraft over the board — were the only imagery on the site with no generator
script anywhere in either repo. They were made by hand, and so they were a single
daylight frame served to dark-mode readers too, with no pair to choose from.

`shots.mjs` gains a `play` capability beside `aim`: a shot names a control mode,
the script clicks the app's own mode dock, and only then shoots — with the HUD
deliberately left in frame, because on these three the body and its readout ARE
the subject. `#mode-dock` and `#play-hud` are in FURNITURE.BARE rather than
CLUTTER for that reason, and there is a comment at the `hide()` call so a later
tidy-up does not crop the subject out.

Three guards, each verified by deliberately making it fire:

  - the mode must be OFFERED, not merely present — asking for `drive` on the Bay
    Area board now says `"drive" is not offered here — the dock is showing
    [overview, actor]`;
  - `aria-pressed="true"` AND `#play-hud` unhidden, the same pair
    `performance-budget.mjs` waits on;
  - the HUD's own body chip, so asking for `Explore` when an anonymous visitor
    gets a crow says `the play HUD says "Crow", not "Explore"`.

The body guard runs twice, at the click and again at the shutter, because a
completed route or a bound ends a mode mid-wait and hands back an orbit wide shot
under the right filename.

`untilProgress` exists because the first delivery drifted: `run: 9000` gave 55% of
the leg in a 1x preview and 69% in the 2x render — a different stretch of road,
with a town's edge across the top of the frame. Road traffic runs from page load,
so a duration is really "boot plus a bit". Waiting on the app's own route
percentage lands preview and delivery on the same frame; overshoot throws rather
than shooting. The crow and the aircraft are built inert, so a duration is exact
for them and only the car needed the gate — measured, not assumed.

The run log now echoes the HUD (`[Drive] 56 mph · US-101 | assisted · 55% ·
chase`), because "shot drive-101-day" is equally true of a parked car, a finished
route and a correct frame.

The crow moved from the state board to the Bay Area. On California a one-metre
bird stands against ground drawn at 1,919 m to the unit with an oak the size of a
hill behind it, and the night frame would have been a black rectangle with a bird
in it. `crow-nav-v1`'s `source` said "Tera / California" and that was wrong on the
environment's own terms as well — `crowNav.ts` runs a ±120 m box with no terrain
at all.

One frame is honestly weak and is recorded rather than dressed up: `drive-101`
at night. From behind, on an unlit corridor, the EV is two tail lamps and a roof
strip. Four hours were shot between 21:15 and 20:05 and the corridor's ground is
equally black at all of them, so the hour is not the lever; both real fixes are in
the engine and are in TODO.md. It is still the honest night frame.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

scripts/brand-assets/refresh.mjs

@@ -26,9 +26,9 @@
  * So: one command, and the parts you can skip are flags rather than the memory
  * of which script does what.
  *
- * ### The two failures this must never report as success
+ * ### The three failures this must never report as success
  *
- * Both of them produce output that looks deliberate, which is why they are
+ * All three produce output that looks deliberate, which is why they are
  * checked here rather than left to the eye:
  *
  * 1. **SwiftShader.** `launch()` in `harness.mjs` asks for `--use-angle=vulkan`
@@ -46,6 +46,14 @@
  *    surfaces it as its own headline rather than as one line of a stack trace
  *    fifty lines up the log.
  *
+ * 3. **A `play` guard firing.** Three stills take control of a body before the
+ *    shutter opens — the EV on US-101, the crow over the Bay, the aircraft on the
+ *    corridor — and `enterPlay()` in `shots.mjs` refuses to shoot when the dock
+ *    did not hand over the mode, when the HUD names a different body, or when the
+ *    route ran out during the wait. Every one of those otherwise delivers an orbit
+ *    wide shot under a filename that says an agent is driving. Same treatment as
+ *    the chapter guard, and for the same reason: re-running cannot fix it.
+ *
  * ### It re-stamps the provenance manifest, narrowly
  *
  * `PROVENANCE.json` records a SHA-256 for every tracked binary and
@@ -154,6 +162,19 @@ async function fingerprint() {
 const SOFTWARE_RENDERER = /GPU:.*(SwiftShader|llvmpipe)|no GPU \(/i;
 /** `chapter()` in `shots.mjs`, and the office picker's equivalent beside it. */
 const PACK_REORDERED = /a city pack was reordered|the OFFICES table\s*\n?\s*changed|is "[^"]*", not "/;
+/**
+ * `enterPlay()` in `shots.mjs` refusing to shoot a body it did not get.
+ *
+ * The third headline, and here for the same reason the second one is: three of
+ * the stills are pictures of an agent driving, flying and gliding, and every way
+ * that can go wrong produces a frame that still renders, still looks deliberate
+ * and is of the wrong thing — an overview wide shot with `drive-101-day` written
+ * on it. Re-running does not fix any of them. Either the dock stopped offering
+ * the mode, or the body is not the one the caption describes, or the leg ran out
+ * from under the wait.
+ */
+const BODY_REFUSED =
+  /is not offered here|the mode dock has no|the dock did not take|the play HUD says|did not survive the wait|was already \d+% done|carries no percentage/;
 
 class StepFailure extends Error {
   constructor(step, headline, detail) {
@@ -217,6 +238,23 @@ function run(step, command, args, { cwd = ROOT } = {}) {
         );
         return;
       }
+      if (code !== 0 && BODY_REFUSED.test(log)) {
+        rejectRun(
+          new StepFailure(
+            step,
+            "a play guard fired — a shot did not get the body it asked for",
+            "Three stills take control of something before the shutter opens: the EV on US-101, the\n" +
+              "crow over the Bay, the aircraft on the California corridor. Each asks the mode dock for a\n" +
+              "mode, waits for `aria-pressed` and the play HUD, and asserts which body the HUD names.\n" +
+              "One of those checks refused, and re-running will not fix it: the mode is unavailable on\n" +
+              "that board, or the body changed, or the route ran out during the wait. A frame shot past\n" +
+              "any of those is an orbit wide shot with the right filename.\n" +
+              "`node scripts/brand-assets/shots.mjs --list` prints what each shot asks for. Do not\n" +
+              "weaken the guard.",
+          ),
+        );
+        return;
+      }
       if (code !== 0) {
         rejectRun(new StepFailure(step, `${step} failed (exit ${code})`, "The child's own output is above."));
         return;