feat: download only config-selected models in setup

[tyvsmith]

Summary

• Previously facelock setup always downloaded all non-optional models (scrfd_2.5g + w600k_r50) plus any optional models the config referenced, even when the user had configured a completely different model pair
• Changed the filter in both wizard_model_download and run_non_interactive to select exactly the models named in recognition.detector_model and recognition.embedder_model
• First-run behavior is unchanged: config defaults resolve to scrfd_2.5g + w600k_r50 so those are still downloaded on fresh installs
• Re-running setup after changing the config (e.g. switching to det_10g + glintr100 for high accuracy) now downloads only the newly-selected models
• Already-present models are still verified and skipped (no re-download)
• Added #[allow(dead_code)] to ModelEntry::optional which is still deserialized from the manifest TOML and used in tests

Re-opens #25 (auto-closed when its stacked base branch was deleted on #24 merge). Rebased onto current main.

Test plan

• cargo build --workspace passes
• cargo clippy --workspace -- -D warnings passes with zero warnings/errors
• cargo test --workspace passes (all 274 tests pass)
• Manually verify: configure det_10g.onnx + glintr100.onnx in config, run facelock setup --non-interactive, confirm only those two models are downloaded

[Copilot]

Pull request overview

This PR updates facelock setup to download (and verify/skip) only the face recognition models explicitly selected in the user’s config, instead of always downloading the default non-optional models as well.

Changes:

• Restrict model selection in both interactive and non-interactive setup flows to recognition.detector_model and recognition.embedder_model.
• Add #[allow(dead_code)] to ModelEntry::optional since it’s still deserialized and used by tests but no longer referenced in non-test code.

Comments suppressed due to low confidence (1)

crates/facelock-cli/src/commands/setup.rs:1020

• Same issue as the wizard: when either configured model filename is not found in the bundled manifest, this filter can produce needed.len() == 0 and non-interactive setup will continue to completion (writing the setup marker) without ensuring the configured models exist and are valid. Consider resolving each configured model individually (manifest entry -> download/verify; non-manifest -> verify file exists in model_dir and validate against the configured *_sha256, otherwise fail with an actionable error).

    // 3. Check and download only the models actually selected in the config.
    //    Non-optional (default) models that aren't referenced by the config are
    //    skipped — if the user chose different models there is no reason to fetch
    //    the defaults as well.  On a first run the config defaults resolve to the
    //    standard models (scrfd_2.5g + w600k_r50) so those are still downloaded.
    let configured_detector = &config.recognition.detector_model;
    let configured_embedder = &config.recognition.embedder_model;

    let needed: Vec<&ModelEntry> = manifest
        .models
        .iter()
        .filter(|m| m.filename == *configured_detector || m.filename == *configured_embedder)
        .collect();

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.