kernel: bbox/polygon geometry as a pydantic discriminated union (replaces Annotation.geometry: dict)

[JArmandoAnaya]

Replaces Annotation.geometry: dict[str, object] with a real discriminated union on type.

What landed

• kernel/domain/geometry.py — BboxGeometry {x, y, width, height}, PolygonGeometry {points: [[x, y], ...]}, ClassificationGeometry {}, joined as Geometry = Annotated[..., Field(discriminator="type")].
• The discriminator values are GeometryType members, not parallel string literals, so annotation.geometry.type is directly comparable to a schema's allowed geometries — AnnotationService (kernel: AnnotationService — schema-validated writes (hard reject: unknown class, disallowed geometry, missing required attribute), provenance, UUID identity #7) needs no translation layer.
• Variants are frozen=True, extra="forbid": a bbox payload carrying points is rejected rather than silently validating.
• Model-level rejections: non-positive width/height (a zero-area box is as meaningless as a negative one), polygons with fewer than three points, and payloads naming a GeometryType that has no model yet (mask, polyline, the 3D variants).
• Self-intersection is deliberately not validated in M1 — documented on the model.
• tests/kernel/test_annotation.py's fixture used abbreviated w/h; updated to width/height.

Scope note

Acceptance criterion 2 names AnnotationService and allowed_geometries, which belong to #7 and #6 respectively and do not exist yet (kernel/services/ is empty; LabelClass carries a singular geometry). It is satisfied here at the model level — the union makes the check a plain membership test, proven by a test against the existing LabelClass.geometry. No service was created; #7 still owns the enforcement.

Gates

Gate	Result
uv run pytest	40 passed (29 baseline + 11 new)
uv run ruff check .	All checks passed
uv run ruff format --check .	54 files already formatted
uv run mypy src/visionset/kernel	no issues in 27 files
uv run mypy src/visionset	no issues in 37 files
uv run lint-imports	2 contracts kept, 0 broken
scripts/export_openapi.py	no drift (no route references Annotation)

Frontend untouched, so frontend gates are not implicated.

Closes #10