fix(presence): derive the empty-room boundary from the reference quiet floor - #1917

Symptom

A three node ESP32-S3 rig (192 subcarriers, channel 11) reported zero
occupants for a whole still phase while a person sat motionless on the floor,
so person_count stayed 0 and the publication gate, which requires exactly one
occupant, never opened. The vitals detectors kept producing estimates the whole
time; they were simply never allowed out.

Root cause

finalize_calibration stores p95(calibration window residuals) * 1.5 as the
empty-room boundary. Any disturbance during the ten minute hold - a person, an
animal, a door, an appliance, motion in an adjacent room - lands in that upper
tail, and the boundary then sits far above the settled empty level.

MEASURED on that rig:

The occupant stayed inside the learned boundary for the entire still phase.
The same inflated boundary also feeds field_bridge::perturbation_occupancy, so
the count path and the empty-room match were wrong together.

Boundary sweep over the recorded labelled windows

Detection of the still occupant, with no false positive in the recorded empty
window (3.70-5.50, 70 s):

Change

• EmptyRoomReferenceStats derives p25/p50/p75/p95 and 1.4826 * MAD from the
  retained reference windows.
• effective_empty_room_threshold() applies the tighter of the learned boundary
  and p25 * EMPTY_ROOM_RESIDUAL_MARGIN. The lower quartile estimates the quiet
  floor of the room and is not moved by a still occupant or by a transient
  during calibration. It can only tighten the learned suppression range, never
  widen it, so a quiet calibration keeps exactly the boundary it had.
• field_bridge::perturbation_occupancy uses the same effective boundary as
  empty_room_match, so the occupancy count and the empty-room match cannot
  disagree.
• empty_room_match now also reports the stored boundary, the reference p50 and
  robust scale, and a contamination flag, so a disturbed calibration is visible
  instead of being inferred from an invisible occupant.

Tests

cargo test -p wifi-densepose-signal --lib ruvsense::field_model
# 36 passed, including:
#   disturbed_calibration_reference_tightens_the_effective_boundary
#   quiet_calibration_reference_is_not_flagged_contaminated
cargo check -p wifi-densepose-sensing-server

Limits, stated plainly

• The empty window used for the false-positive column is 70 s long, so "0%"
  means no crossing in that window, not a measured false-alarm rate over a long
  empty period. A longer verified-empty capture is still needed.
• The room's residual floor is not perfectly stationary: calibration 1's own
  reference median (6.7) sat above the settled empty level measured minutes
  later (3.70-5.50). A boundary learned once is therefore a weak detector on
  this rig, and a tracked quiet floor is the next step.
• Related context, not claimed as fixed here: 4x ESP32-S3 occupancy detection - what works, what doesn't, and questions on the intende d detection methods #1804 reports the mirror-image
  failure (a calibrated model still reporting presence in an empty home), which
  is the same boundary-versus-settled-floor question from the other side.