Add guarded promoted YOLO activation

scripts/README.md

@@ -648,6 +648,24 @@ files are present without `--model-file`. It writes only
 `GEOINTEL_INSTALL_AI=true`, `YOLO_ENABLED=true`, `YOLO_MODELS_DIR=/app/models`
 and the mounted `YOLO_MODEL_PATH`.
 
+When a split-background promotion report recommends a specific candidate, use
+the guarded activation helper instead of choosing a model path manually. The
+helper validates the exact `candidate_key`, promotion status and local model
+asset before writing anything, and it mutates `.env` only with `--apply`:
+
+```bash
+python scripts/activate_promoted_yolo_candidate.py \
+  --promotion-report /mnt/user/appdata/geointel/artifacts/detection-model-promotion/split-aware/aoi1024bg512r3e50-high-threshold-split-20260710T222934Z/detection_model_promotion_report.json \
+  --candidate-key 'geointel-building-yolov8s-aoi1024bg512r3e50-pt|512|64|0.35' \
+  --models-dir /mnt/user/appdata/geointel/models \
+  --env-file /mnt/user/appdata/geointel/.env \
+  --json
+```
+
+Add `--apply` only after reviewing the emitted updates. The helper never
+downloads weights, loads the model or runs inference; restart or rebuild the
+container after applying because `YOLO_MODEL_PATH` is read from the environment.
+
 Tower-local model evaluation status:
 
 - `geointel-building-yolov8s-hardneg160r4e50.pt` is available as an evaluated