docs: calibration guide + trust/engine-error diagnostics (closes #1456)

[ruvnet]

Summary

Closes #1456 (follow-up documentation gap tracked from #1401). Two new operator-facing docs, both grounded in the actual Rust source (not ADR aspirational prose) — every specific number/threshold below is cited with a file:line and was spot-checked against source before this PR was opened.

docs/calibration-guide.md

• The empty-room baseline has a hard, enforced minimum of 600 frames (DEFAULT_MIN_FRAMES, wifi-densepose-signal/src/ruvsense/calibration.rs:48) — calibrate fails outright below it, it doesn't degrade silently.
• Documents the real per-anchor quality gate thresholds used by enroll (AnchorQualityGate), and that train-room only requires a non-empty anchor list — a partial anchor set silently produces a bank missing whichever specialists lacked their prerequisite anchors.
• Pets: honest finding — PresenceSpecialist has no size/species discrimination at all, purely amplitude-variance/mean-shift thresholding. Documented as an open limitation, not glossed over.
• Baseline conditions: explains why a steady interferer (HVAC, fan) gets correctly absorbed into "empty" via Welford statistics, but also flags that ADR-135's described drift_score/BaselineDrift staleness system does not exist in the actual code — only a cruder baseline_id-mismatch check in bank.rs is real.

docs/trust-and-engine-errors.md

• Traces engine_error_count and the separate, non-sticky demoted flag to their exact trigger conditions in engine_bridge.rs / wifi-densepose-engine.
• Confirms /health/ready and /api/v1/status share a handler and expose a trust block, but plainly states the real diagnostic gap: no per-cause error breakdown is exposed over the API — the rate-limited log line is the closest thing today.
• Documents the real recovery path for persistent clock-drift demotion (WDP_GUARD_INTERVAL_US, from issue Make multistatic guard_interval_us configurable (hardcoded 5000 µs causes permanent trust demotion with 2 ESP32-S3 nodes) #1049) and that engine_error_count has no reset besides a process restart.
• On the reporter's Hugging-Face-converted-model angle: states plainly that --convert-model and the engine/trust cycle are separate code paths with no call-through found — no invented causal link.

Both docs are added to the README documentation table.

Test plan

• Docs-only change — confirmed via git status/diff that nothing outside docs/ and README.md was touched.
• Spot-checked the load-bearing claims (DEFAULT_MIN_FRAMES = 600, engine_error_count increment/no-reset, WDP_GUARD_INTERVAL_US, demote_one/self.demoted = trust.demoted) directly against source before opening this PR.
• No code changes, so no test/build impact expected — CI should be green on docs alone.

🤖 Generated with Claude Code

Co-Authored-By: claude-flow ruv@ruv.net