t27f: idea factory cover still -- COVER=1 renders the reel's settled title frame, byte-identical to the reel #10828

Part of epic #10560 (the t27f content factory).

Instagram Reels, YouTube Shorts and TikTok each show one still before a reel plays: the cover. Today the idea factory renders only the full reel. To get a cover, someone has to cut a frame out with ffmpeg and guess which frame shows the title once it has settled. Competitors make the still from the same source as the video (Remotion renderStill, CapCut and Opus Clip auto-covers). The factory should make it from the spec too, so the cover can never come from a different idea or preset than the reel.

Boundary

• specs/t27f/idea_factory.t27, plus its seal .trinity/seals/t27f_idea_factory.json.
• .claude/skills/t27f/SKILL.md: one bullet on how to cut a cover.
• No other spec changes. This does not touch particle_ds, scene_raster or glyph57.

Scenarios

1. COVER = 0 (the default): the binary writes exactly the reel it writes today, every byte.
2. COVER = 1: the binary writes one 1080x1920 RGB24 frame, 6220800 bytes, and nothing else.
3. That frame is byte-identical to frame cover_frame(IDEA) of the COVER = 0 reel.
4. cover_frame(t) is the last frame of the first scene, when the law's clock has run out and the title has settled.
5. An idea that preflight refuses still writes 0 bytes under COVER = 1.

Requirements

• pub const COVER : i32 = 0; and pub fn cover_frame(t) -> i32.
• main simulates frames 0..cover_frame under COVER = 1, but only rasters the last of them, so the physics state matches the reel's.
• No ! in the new code (codegen trap codegen(zig): unary minus drops the parentheses of its operand: -(a + b) runs as -a + b #6549).

Criteria

• t27c test-report passes with 0 vacuous tests. New tests: cover_frame is in scene 0, inside the reel, and at live(...) == 0, for the sample idea, CTA, RU_IDEA and the batch ideas.
• On the lab, binaries generated with COVER = 1 write 6220800 bytes. cmp against the matching slice of the COVER = 0 output reports no difference. A control, with the cover moved one frame, does differ.
• The COVER = 0 output is md5-identical to the binary before this change.
• Mutants of cover_frame and of the raster guard are killed.
• The t27b front end reports 0 unsupported constructs. The seal matches.

Requirements

FR-001: The spec specs/t27f/idea_factory.t27 MUST declare pub const COVER : i32 = 0; and pub fn cover_frame(t) -> i32.

FR-002: When COVER = 1, main MUST simulate frames 0..cover_frame(IDEA) but MUST raster only the final frame, so physics state matches the COVER = 0 reel.

FR-003: The COVER = 1 binary MUST write exactly one 1080x1920 RGB24 frame (6,220,800 bytes) and nothing else.

FR-004: The frame produced under COVER = 1 MUST be byte-identical to frame cover_frame(IDEA) of the COVER = 0 output.

FR-005: cover_frame(t) MUST return the last frame of the first scene where the law's clock has run out and the title has settled (live(...) == 0).

FR-006: An idea rejected by preflight MUST produce 0 bytes of output when COVER = 1.

FR-007: The new code MUST contain no ! (codegen trap #6549).

FR-008: .claude/skills/t27f/SKILL.md MUST gain one bullet describing how to cut a cover.

FR-009: The seal .trinity/seals/t27f_idea_factory.json MUST be updated to match the changed spec.

Success Criteria

• t27c test-report passes with 0 vacuous tests; new tests verify cover_frame is in scene 0, inside the reel, and at live(...) == 0 for sample idea, CTA, RU_IDEA, and batch ideas — exit 0
• COVER=1 binary writes 6220800 bytes; cmp <(./bin COVER=1) <(dd if=./bin COVER=0 bs=6220800 skip=1 count=1 2>/dev/null) reports no difference; same cmp with cover frame ±1 differs — exit 0
• COVER=0 output is md5-identical to pre-change binary — md5sum matches — exit 0
• Mutants of cover_frame and the raster guard are killed — 5 tests minimum
• t27b front end reports 0 unsupported constructs — exit 0
• Seal .trinity/seals/t27f_idea_factory.json matches regenerated spec — exit 0