[AZ-657] [AZ-682] frame_ingest RTSP lifecycle + scan_controller FSM (batch 12)

AZ-657 (frame_ingest): RTSP session lifecycle FSM with bounded
exponential backoff (1 s → 30 s cap), AI-lock plumb through
watch::Sender that stamps every emitted Frame, and SPS/PPS
hard-fail via OpenError::UnsupportedProfile. The actual RTSP wire
client is abstracted behind an RtspTransport trait so AZ-658 can
pin retina/FFmpeg alongside the decoder; the lifecycle FSM itself
is production code today. tokio::select! around every transport
call so a hung open/read cannot wedge graceful shutdown. 10 unit +
5 integration tests cover happy path, bounded reconnect, stream-
drop reopen, hard-fail no-retry, and AI-lock toggle.

AZ-682 (scan_controller): typed ScanState (ZoomedOut / ZoomedIn /
TargetFollow) with a complete pure transition catalogue, every
(state, trigger) → next_state from description.md §1/§4/§5 covered;
spec-disallowed combos return TransitionOutcome.accepted = false
with RejectReason::UnsupportedTransition (loud, not silent). Frame-
rate floor monitor with hysteresis suppresses ZoomedOut → ZoomedIn
while sustained FPS < 10 fps per description.md §5/§6. Rolling
100-sample tick-latency window surfaces p99; health goes yellow
above the 10 ms budget. 18 unit + 5 integration tests cover the
catalogue, fps-floor activate/clear, and tick-latency budget.

Cumulative review (batches 10-12): all OPEN findings carried
forward without regressions. See
_docs/03_implementation/batch_12_cycle1_report.md §6.

Notes: pre-existing dead-code error in autopilot::Runtime::
vlm_provider_name (origin batch 4) blocks workspace -D warnings
clippy. Recorded in _docs/_process_leftovers/ — not in batch 12
scope.

Co-authored-by: Cursor <cursoragent@cursor.com>

_docs/_process_leftovers/2026-05-20_autopilot_clippy.md

@@ -0,0 +1,59 @@
+# Leftover — autopilot dead-code clippy gate
+
+- **Timestamp**: 2026-05-20T05:30:00Z
+- **Source**: discovered during batch 12 (`AZ-657` + `AZ-682`)
+- **Origin**: commit `69c0629` — `[AZ-643] [AZ-665] [AZ-672]
+  mavlink+mapobjects+vlm batch 4`
+- **Blocked operation**: `cargo clippy --workspace --all-targets --
+  -D warnings`
+
+## Symptom
+
+```
+error: method `vlm_provider_name` is never used
+  --> crates/autopilot/src/runtime.rs:84:12
+   |
+58 | impl Runtime {
+   | ------------ method in this implementation
+...
+84 |     pub fn vlm_provider_name(&self) -> &'static str {
+   |            ^^^^^^^^^^^^^^^^^
+   |
+   = note: `-D dead-code` implied by `-D warnings`
+```
+
+`Runtime::vlm_provider_name` is only called from `#[cfg(test)]` code in the
+same file (`runtime.rs:215`, `runtime.rs:228`). Compiling the `autopilot`
+binary target without test cfg flags it as dead code; under `-D warnings`
+this is an error.
+
+## Why not fixed in batch 12
+
+Per `.cursor/rules/coderule.mdc`:
+
+> Pre-existing lint errors should only be fixed if they're in the modified
+> area.
+
+The autopilot crate is outside the AZ-657 / AZ-682 scope (which touch
+`frame_ingest` and `scan_controller` only). Fixing this would expand scope
+and obscure the batch-12 diff. The lint must be cleared before the next
+CI gate that enforces workspace `-D warnings`.
+
+## Recommended fix
+
+Pick the smallest of:
+
+1. `#[cfg(test)]` on the method (it's only called from tests).
+2. `#[allow(dead_code)]` on the method.
+3. Add a real (non-test) caller — e.g. expose it through the `/health`
+   JSON so the field becomes load-bearing.
+
+Option (3) is preferred because it surfaces a useful field; (1) is the
+narrowest change.
+
+## Replay
+
+This leftover requires no Jira write — it is a code-quality gate. Replay
+on the next autodev tick by either folding (3) into a relevant batch
+(any batch that touches `autopilot/src/runtime.rs` or the health surface)
+or opening a small standalone Maintenance ticket.