backlot: fix all five dogfood findings (F-01..F-05)

- F-01: cost bar crit (red) state past 90% of budget
- F-02: normalize() hardens fetched board state against sparse payloads
- F-03: /thumb 404s for videos with no extractable poster frame instead
  of serving raw video bytes
- F-04: checkpoint artifact path refs only resolve inside the project dir
- F-05 (board half): stall detection — in_progress stage with no disk
  activity >10min renders red 'stalled?' + header badge flips to STALLED?;
  verified against the real wedged why-cities-glow project
- eval harness from dogfood session committed (visual regression +
  interaction smoke, capture watcher, server/gate test suites) +
  regression tests for each finding; 46 backlot tests green, visual eval
  green (restage-before-capture note logged)

backlot/server.py

@@ -239,7 +239,11 @@ def create_app() -> FastAPI:
         width = min(THUMB_WIDTHS, key=lambda x: abs(x - w))
         cached = await asyncio.to_thread(_thumbnail_for, target, width)
         if cached is None:
-            return FileResponse(target)  # not an image we can thumb — serve as-is
+            # Never fall back to raw video bytes for an <img> consumer (F-03);
+            # non-thumbable images are safe to serve as-is.
+            if target.suffix.lower() in {".mp4", ".webm", ".mov"}:
+                raise HTTPException(status_code=404, detail="no poster frame available")
+            return FileResponse(target)
         return FileResponse(cached, media_type="image/jpeg")
 
     # ---- Media (range requests handled by FileResponse) ---------------