refactor(flags): remove dead face_confirm, consolidate unified_pose, cap OpenCV threads

[TCVinNYC]

Flip-switch architecture cleanup + a real CPU-oversubscription fix.

Changes

• Remove dead face_confirm knob — the per-camera "Confirm with face recognition" toggle never gated engine behaviour (face is controlled by the global face_recognition module switch). Removed the config field, UI checkbox, and telemetry use; telemetry configured now reflects the actual feature flag. Old configs ignore the stale key (no extra=forbid).
• Consolidate unified_pose — single resolver autoptz.engine.runtime.flags.env_unified_pose; the inference pool and worker stacks share one source of truth instead of two duplicate env readers.
• Cap OpenCV threads — cv2.setNumThreads was never called, so OpenCV (resize/letterbox + the per-frame ego optical-flow) fanned across all cores while the ORT sessions were already capped. New flags.apply_opencv_thread_cap caps it to the same per-camera budget, applied in the supervisor and re-applied in the process-per-camera child. macOS-GCD-aware: that backend ignores a positive count (only 0 works), so the cap forces single-threaded only under heavy multi-camera load; TBB/OpenMP backends honour the exact count.

Tests

• New tests/test_flags.py (18 cases; OpenCV-backend-portable contract).
• Full suite green locally (1033 passed), ruff check + format clean.

Notes

• Behaviour change: OpenCV thread cap. Conservative (caps to the existing per-camera budget). On a few-camera macOS setup it's effectively a no-op (GCD); the real macOS lever for optical-flow cost is ego-flow decimation (tracked separately).

🤖 Generated with Claude Code