Keep rollout selection separate from decoder failure policy

Observation (2026-09-09, staging Safari diagnosis plus COR-4111 source/tests in e3-solutions/theft): a canary-only post-selection fallback policy turned one realtime frame deadline into termination of an otherwise continuous latest-frame scan loop, and an intermediary-replaced 504 body made that boundary easier to trigger. The simpler reusable contract is for canary to control only initial decoder selection; once Adam is selected, direct and canary modes share the same bounded one-in-flight/one-replaceable-frame realtime policy. Stored-image work remains separately bounded: one Adam attempt, then exactly one local rescue after any non-success. Keep proxy/body normalization at the transport boundary rather than branching the scanner state machine by rollout mode.