fix(falcon): gz-plant findings from the v1.117 recording sessions

[avrabe]

Verify-Filter: (has-tag "rotor-loss")

Three measured fixes from flying the supervised rotor-out landing on the real gz plant (the recording sessions):

1. FDI rate gate 1 → 2 rad/s — the gz hover limit-cycle (~1 rad/s roll/pitch, gz plant hovers with an attitude limit-cycle (~1 rad/s roll/pitch, motor thrash 0.1↔1.0) #270) held the gate chronically shut; the FDI lost the race against the runaway detector on a genuine rotor kill (Terminate at kill+0.6 s — the new idle-mode motors-off acted correctly, but on the wrong failsafe). A true tumble is >3 rad/s; false-trip protection lives in the v1.115 command-aligned residual. Result on gz: kill 12.0 s → touchdown+Disarmed 13.2–15.6 s, repeatably (3 consecutive PASS runs). Suites: falcon-core 45/45, falcon-sitl-gz 32/32.
2. NavSat datum guard — the 3 s first-fix wait raced gz discovery (2-in-3 runs → silent 488 m MSL leak → runaway climb or refused takeoff). Now 15 s, loud capture log, and refuses to fly without a datum.
3. Video tooling — flight-column camera framing + the layered-caption annotation script for the release video.

🤖 Generated with Claude Code