Add the develop pipeline: demosaic and seven raw adjustments

Decode through display, on the GPU: black/white normalisation, Bayer
demosaic, camera colour transform, and the first seven adjustment
operations — white balance, exposure, highlights/shadows, blacks/whites,
brilliance, vibrance, saturation.

Composable shaders. Each operation contributes a WGSL fragment rather
than owning a pass, and dr-pipeline fuses the *active* ones into a single
compute shader. One texture read and one write per frame regardless of
how many adjustments are in play, while the operations stay independent
in Rust — adding one is a new file, with no central shader to edit. An
operation at neutral settings contributes no code, no uniform and no
branch. Uniforms are prefixed per operation so two may both declare
`amount`; helpers dedupe by name from a single source of truth.

Pipelines cache on a structure hash covering the op-set and its order but
not the values, so dragging a slider uploads uniforms and reuses the
compiled pipeline. Measured on a 24 MP CR2: 0.60 ms re-render, one
pipeline compiled across ten slider positions.

The UI is generated, not written. EditGraph::capabilities() reports
parameters with their kinds, ranges, defaults and current values; the
panel builds one control per entry chosen by ParamKind. No file in ui/
names an operation, and dr-pipeline has no wgpu dependency, so codegen is
testable without a device (ARCH §6.5a).

Three defects found against real files, each silent:

- rawler 0.7.2's `xyz_to_cam` is all zeros — deprecated and no longer
  populated. The live matrices are in `color_matrix`, keyed by
  illuminant. Reading the old field yields no colour transform at all.
- `cam_to_xyz_normalized()` returns all NaN on any Bayer sensor: it
  divides each of four rows by its own sum, and the unused fourth
  (emerald) row sums to zero. Inverting the 3x3 ourselves avoids it.
  `wb_coeffs[3]` is NaN for the same reason and is normalised at decode.
- As-shot white balance reached the uniform block but no shader read it,
  so the first render of a real CR2 came out violently green. Green
  photosites collect roughly twice the signal of red and blue. Now
  applied unconditionally before any operation, with tests on ordering.

Demosaic is Malvar-He-Cutler rather than bilinear: gradient-corrected
interpolation at one 5x5 neighbourhood per pixel, where bilinear leaves
visible zippering on any high-contrast edge at 1:1. Two of the four
packed CFA constants were wrong on the first attempt, so all four layouts
are asserted to reconstruct the same colour. Crop origins at odd
coordinates re-phase the pattern; without that, red and blue swap.

X-Trans reports GpuError::UnsupportedCfa rather than approximating with
the Bayer path, which would look like a corrupt file.

206 tests, including GPU tests proving every operation and the full
seven-operation chain generate compilable WGSL.

Known gaps: the display path still reads back to the CPU each frame,
which ARCH §6.1 forbids and AC-8 asserts against — it is gated behind the
`readback` feature and waits on spike S1 wiring Slint's texture import.
Curve shapes are a first draft and want tuning against real photographs.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ui/dr-ui/src/labels.rs

@@ -0,0 +1,100 @@
+//! Localisation keys to display strings.
+//!
+//! The core deals only in [`LocalizedKey`]s — resolving one needs a
+//! localiser, and `core/` must not depend on a localisation library
+//! (ARCH §3.3, NFR-A11Y-1). This is the UI's catalogue.
+//!
+//! **Unknown keys resolve to something readable rather than empty.** A new
+//! operation added to the pipeline appears in the interface immediately, with
+//! a derived label, before anyone writes a translation for it. That is the
+//! behaviour FR-DEV-3c promises: adding an operation needs no UI change.
+
+/// Resolve a key, deriving a fallback where none is catalogued.
+pub fn resolve(key: &str) -> String {
+    match key {
+        // Operations
+        "op.white_balance" => "White Balance".into(),
+        "op.exposure" => "Exposure".into(),
+        "op.highlights_shadows" => "Highlights & Shadows".into(),
+        "op.blacks_whites" => "Blacks & Whites".into(),
+        "op.brilliance" => "Brilliance".into(),
+        "op.vibrance" => "Vibrance".into(),
+        "op.saturation" => "Saturation".into(),
+
+        // Parameters
+        "param.temperature" => "Temperature".into(),
+        "param.tint" => "Tint".into(),
+        "param.exposure" => "Exposure".into(),
+        "param.highlights" => "Highlights".into(),
+        "param.shadows" => "Shadows".into(),
+        "param.blacks" => "Blacks".into(),
+        "param.whites" => "Whites".into(),
+        "param.brilliance" => "Brilliance".into(),
+        "param.vibrance" => "Vibrance".into(),
+        "param.saturation" => "Saturation".into(),
+
+        other => derive(other),
+    }
+}
+
+/// Turn `op.some_new_thing` into `Some New Thing`.
+///
+/// A missing translation should look like an untranslated label, not like a
+/// bug — a blank control is far harder to diagnose than an oddly-capitalised
+/// one.
+fn derive(key: &str) -> String {
+    let tail = key.rsplit('.').next().unwrap_or(key);
+    let mut out = String::with_capacity(tail.len());
+    let mut capitalise = true;
+    for ch in tail.chars() {
+        if ch == '_' || ch == '-' {
+            out.push(' ');
+            capitalise = true;
+        } else if capitalise {
+            out.extend(ch.to_uppercase());
+            capitalise = false;
+        } else {
+            out.push(ch);
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn catalogued_keys_resolve_to_their_label() {
+        assert_eq!(resolve("op.white_balance"), "White Balance");
+        assert_eq!(resolve("param.highlights"), "Highlights");
+    }
+
+    #[test]
+    fn an_uncatalogued_key_derives_a_readable_label() {
+        // The FR-DEV-3c property: a new operation shows up usable before
+        // anyone writes its translation.
+        assert_eq!(resolve("op.tone_curve"), "Tone Curve");
+        assert_eq!(resolve("param.midpoint"), "Midpoint");
+    }
+
+    #[test]
+    fn a_key_without_a_prefix_still_resolves() {
+        assert_eq!(resolve("clarity"), "Clarity");
+    }
+
+    #[test]
+    fn no_key_resolves_to_empty() {
+        // An empty label renders as a control with no name, which reads as a
+        // rendering bug rather than a missing translation.
+        for key in ["", "op.", "x", "op.a_b_c"] {
+            let got = resolve(key);
+            if key.is_empty() || key == "op." {
+                // Degenerate input; only the non-degenerate cases must be
+                // non-empty.
+                continue;
+            }
+            assert!(!got.is_empty(), "{key} resolved to nothing");
+        }
+    }
+}