Draw the repairs, before anything sharpens what they removed

A spot set now composes detail passes of its own, one per round, and they
go ahead of every operation's kernel. That placement is the decision worth
recording: a sharpening pass reads a neighbourhood, so sharpening a dust
mark before removing it smears its edge into pixels the repair's disc does
not cover, and what survives is a faint over-sharpened ring around an
otherwise perfect patch. It also disagrees with ARCH §5.2, which draws
spot removal after clarity — docs/spot-removal.md §5.1 is where that is
argued out.

Every length reaching the shader is in render pixels, converted here where
the framing is in scope. Both the centre and the source go through
`Framing::output_at` — the same map the fused pass applies to every pixel
— so a rotated photograph rotates the offset with no trigonometry, and the
radius is found by mapping a point one radius above the centre and
measuring, rather than by multiplying by a ratio this function has no
business knowing about. The tests turn and crop the frame and expect the
mark to stay gone, which is the property that arrangement buys.

compose_full now takes the spot set, because a photograph with a repair
and no sharpening still has a detail stage: a fused pass that encoded its
own output there would quantise twice and bind to a texture of the wrong
format. compose_detail_for takes the source size for the same kind of
reason — a RenderScale describes the region on screen, and a spot is
stored against the photograph.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

core/dr-pipeline/src/graph.rs

@@ -443,7 +443,7 @@ impl EditGraph {
     /// graph renders to the screen and to a file in the same breath, and the
     /// two want different answers.
     pub fn compose_for(&self, output: dr_types::ColourSpace) -> ComposedShader {
-        compose_full(&self.ops, &self.framing, output, &self.masks)
+        compose_full(&self.ops, &self.framing, output, &self.masks, &self.spots)
     }
 
     /// TRACES: FR-DSP-1
@@ -484,9 +484,10 @@ impl EditGraph {
     /// single encoded dispatch it always has.
     pub fn compose_detail(
         &self,
-        scale: crate::detail::RenderScale,
+        source: (u32, u32),
+        render: (u32, u32),
     ) -> crate::detail::ComposedDetail {
-        self.compose_detail_for(scale, dr_types::ColourSpace::Srgb)
+        self.compose_detail_for(source, render, dr_types::ColourSpace::Srgb)
     }
 
     /// TRACES: FR-EXP-2
@@ -497,12 +498,21 @@ impl EditGraph {
     /// transform — the fused pass stops at linear working values. Composing
     /// the two halves for different spaces would encode the edit twice, or
     /// not at all.
+    /// `source` is the demosaiced image's size and `render` the size being
+    /// drawn. The scale is worked out here rather than handed in, because the
+    /// repairs need the *source* size as well — a spot is stored in normalised
+    /// source coordinates and has to be put through the framing to find out
+    /// where it lands on this render, and a [`crate::detail::RenderScale`]
+    /// describes the region on screen rather than the photograph.
     pub fn compose_detail_for(
         &self,
-        scale: crate::detail::RenderScale,
+        source: (u32, u32),
+        render: (u32, u32),
         output: dr_types::ColourSpace,
     ) -> crate::detail::ComposedDetail {
-        crate::detail::compose_detail(&self.ops, scale, output)
+        let scale = self.render_scale(source, render);
+        let spots = self.spots.passes(&self.framing, source, scale);
+        crate::detail::compose_detail_with(&self.ops, &spots, scale, output)
     }
 
     /// TRACES: FR-DEV-3d