Hand out descriptors a declaration could produce

`Operation::descriptor()` returned `&'static OpDescriptor`, and that lifetime
is the whole reason a build-time node is free and a run-time node is
impossible: only a compile-time literal can satisfy it, so no amount of
reading `ops/*.yaml` at startup could ever produce a descriptor the rest of
the application would accept. FR-PLG-2 says a bundled operation and a
third-party plugin are the same kind of thing, differing only in where the
file was found — and a lifetime outsiders cannot meet is exactly the second,
weaker format that requirement forbids.

So a descriptor is now owned and handed out as `Arc<OpDescriptor>`, with `Vec`
where it held `&'static` slices. `Arc` rather than a `&self`-borrowed
reference because the callers want to *keep* it: the develop panel collects
descriptors and then mutates the graph, and a borrow would tie the
descriptor's lifetime to a borrow of the operation it came from, which is the
one thing `&'static` was doing right.

The identifier newtypes deliberately did not follow. `ParamId` is `Copy`, is
compared in `match` arms against generated constants, is a map key in the
sidecar and history, and reaches Slint model rows; an `Arc<str>` there would
cost a refcount on every one of those and would take `match id { EXPOSURE =>
.. }` away from the generated code. They gain an interner instead, which is
honest about its lifetime rather than pretending to one — the set of ids is
bounded by deduplication and is process-lifetime by construction, because the
sidecar on disk names its parameters and an id has to stay resolvable for as
long as any edit naming it can be opened.

No behaviour changes. Every descriptor that was a `static` is a `LazyLock`
initialiser now, `Operation::helpers` borrows from `self` instead of being
`'static` so a future run-time node can own its list, and `Warp` and `Framing`
follow `Operation` so there is one shape rather than two.

The one place a descriptor is read per frame is `compose_full`, which takes
`descriptor().id` to prefix each active operation's uniforms, and `dr-ui`
composes on every frame it draws. That is a dozen atomic increments beside a
composition that is already building several kilobytes of WGSL on the same
call; it is noted at the trait method rather than left for a profiler to find.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

core/dr-pipeline/src/ops/film_sim.rs

@@ -29,6 +29,7 @@
 //! Declared as a plain struct here rather than imported, so that dr-pipeline
 //! keeps its no-dependency property (ARCH §6.5a) exactly as `vignetting` does
 //! with `Pa`.
+use std::sync::{Arc, LazyLock};
 
 use crate::descriptor::{Attribute, LocalizedKey, OpDescriptor, OpId, ParamDescriptor, ParamId};
 use crate::operation::{Operation, Uniform};
@@ -73,29 +74,31 @@ static MATRIX_FIELDS: [[&str; 3]; 3] = [
     ["m20", "m21", "m22"],
 ];
 
-static DESCRIPTOR: OpDescriptor = OpDescriptor {
-    // Tone and colour both, and not `Effect`: a stock is not something applied
-    // on top of a photograph, it is what the photograph was made on.
-    attributes: &[Attribute::Tone, Attribute::Colour],
-    id: ID,
-    label: LocalizedKey("op.film_sim"),
-    params: &[
-        ParamDescriptor::stops("exposure", "param.film_sim.exposure", -3.0, 3.0),
-        ParamDescriptor::stops("print_exposure", "param.film_sim.print_exposure", -3.0, 3.0),
-        // TRACES: FR-DEV-3f
-        // Development, in stops of push. Bounded by what the manufacturers
-        // actually published: Double-X's measured axis spans about -1 to +2,
-        // and beyond a range like that a curve would have to be invented.
-        ParamDescriptor::stops("push", "param.film_sim.push", -1.0, 3.0),
-        // TRACES: FR-DEV-3f
-        // Which frame this was taken on — the half of the enlargement a
-        // photograph cannot supply. A crystal is a fixed size in micrometres,
-        // so how grainy a picture looks is film size against output size, and
-        // the same emulsion on 4x5 renders about three times smoother than on
-        // 35mm at the same print.
-        ParamDescriptor::choice("format", "param.film_sim.format", &FORMATS),
-    ],
-};
+static DESCRIPTOR: LazyLock<Arc<OpDescriptor>> = LazyLock::new(|| {
+    Arc::new(OpDescriptor {
+        // Tone and colour both, and not `Effect`: a stock is not something applied
+        // on top of a photograph, it is what the photograph was made on.
+        attributes: vec![Attribute::Tone, Attribute::Colour],
+        id: ID,
+        label: LocalizedKey("op.film_sim"),
+        params: vec![
+            ParamDescriptor::stops("exposure", "param.film_sim.exposure", -3.0, 3.0),
+            ParamDescriptor::stops("print_exposure", "param.film_sim.print_exposure", -3.0, 3.0),
+            // TRACES: FR-DEV-3f
+            // Development, in stops of push. Bounded by what the manufacturers
+            // actually published: Double-X's measured axis spans about -1 to +2,
+            // and beyond a range like that a curve would have to be invented.
+            ParamDescriptor::stops("push", "param.film_sim.push", -1.0, 3.0),
+            // TRACES: FR-DEV-3f
+            // Which frame this was taken on — the half of the enlargement a
+            // photograph cannot supply. A crystal is a fixed size in micrometres,
+            // so how grainy a picture looks is film size against output size, and
+            // the same emulsion on 4x5 renders about three times smoother than on
+            // 35mm at the same print.
+            ParamDescriptor::choice("format", "param.film_sim.format", FORMATS.to_vec()),
+        ],
+    })
+});
 
 /// A stock reduced to what a shader runs, as `dr-film` bakes it.
 ///
@@ -190,8 +193,8 @@ impl FilmSim {
 }
 
 impl Operation for FilmSim {
-    fn descriptor(&self) -> &'static OpDescriptor {
-        &DESCRIPTOR
+    fn descriptor(&self) -> Arc<OpDescriptor> {
+        DESCRIPTOR.clone()
     }
 
     fn set_param(&mut self, id: ParamId, value: f32) {