Projection chips redraw the preview; auto-crop as the DNG default crop

Picking a chip stored the choice for the merge and changed nothing on
screen — the chip did not even highlight, since the selected property
was never written back. Now the pick is reflected, and the job, waiting
for its decision, takes a Preview request, draws the alignment on the
chosen surface at proxy cost and reports again; the drain puts the new
picture and its size up. Auto is the surface the field of view suggests.

Also:
The largest rectangle inside the frames' coverage is found a row at a
time — a histogram of consecutive covered rows and a stack pass per row —
so the composite is never held to be measured (FR-MRG-11). It is written
as DefaultCropOrigin/DefaultCropSize (FR-MRG-4): the file opens on the
picture, the border is still in it, and resetting the crop shows it.
rawler reports the crop as the picture, which the test checks.

FR-MRG-4 records the question raised the same day — fill the border
rather than crop it — as open: a non-generative fill through the heal,
or a generative inpainter with its licence and weights. Neither decided.

docs/requirements.md

@@ -1732,6 +1732,13 @@ field of view and overridable; the horizon levelled from the estimated rotations
 drag; auto-crop to the largest inscribed rectangle, overridable. No boundary fill: painting pixels
 that were never captured is the pixel editing §1.3 excludes.
 
+*The auto-crop is non-destructive* (built 2026-09-19): it is the composite's default crop, not a
+cut — the whole merge including its border is in the file, and resetting the crop shows it.
+*Boundary fill is an open question, raised the same day:* a fill of the border from the picture's
+own edge through FR-DEV-8's heal would be non-generative and honest about what it is; a generative
+inpainter is a model licence, hundreds of megabytes of weights and an inference path the
+application does not have. Neither is decided; the clause stands as written until one is.
+
 **FR-MRG-5 — Honesty of failure.** *(general to any merge)* A frame that cannot be aligned is
 named, with why — too few matches, no overlap with any other frame, a residual above the stated
 bound — and the merge stops. Never a silent drop, never a best-effort composite with a frame