Tell the shader which colour space it is encoding for

The generated shader ended with `encode_srgb` and a clamp, so every
photograph leaving DarkRoom had been through sRGB's gamut whatever the
settings page said. Export refused the other three spaces rather than
tag clipped pixels with a gamut they did not contain — correct, and
not something an encoder could fix.

So the output space becomes a parameter of composition. `compose_for`
emits a constant primaries matrix after the camera matrix and before
the clip, and generates the transfer function to match: the sRGB curve
for sRGB and Display P3, a pure 2.199 gamma for Adobe RGB, 1.8 with a
linear toe for ProPhoto. The ordering the camera matrix depends on is
untouched — operations still run in camera space — and sRGB emits no
conversion at all, so the shader compiled on nearly every frame is
byte-for-byte what it was.

The numbers live in dr-types, derived from four chromaticity pairs per
space rather than tabulated. That is not tidiness: the shader encodes
the pixels and the ICC profile describes them, and a file whose profile
disagrees with its own contents is worse than one with no profile. One
derivation makes them agree by construction, and can be checked against
the values the specifications publish.

Profiles are generated here too — minimal v2 matrix/TRC, about 2 KB,
pure Rust, no lcms to satisfy under the NDK. A JPEG carries it in APP2,
a PNG in iCCP, a TIFF in tag 34675. sRGB gets one as well, because
untagged does not mean sRGB, it means guess.

The refusal survives in a sharper form. A `Frame` now carries the space
it was rendered in, and export refuses to label it anything else. The
develop session still composes for sRGB, so a P3 export from the
interface fails with an accurate error instead of producing a file that
lies — the frontend half is a separate change.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

core/dr-pipeline/src/graph.rs

@@ -285,9 +285,24 @@ impl EditGraph {
         !self.ops.iter().any(|o| o.is_active()) && !self.framing.edits_image()
     }
 
-    /// Generate the fused shader for the current state.
+    /// Generate the fused shader for the current state, encoded to sRGB.
+    ///
+    /// What the display path wants. An export that has been asked for a wider
+    /// space wants [`Self::compose_for`] instead, and must say so: the space
+    /// is baked into the shader, so a frame rendered by this one is sRGB and
+    /// nothing downstream can make it anything else.
     pub fn compose(&self) -> ComposedShader {
-        compose_with_framing(&self.ops, &self.framing)
+        self.compose_for(dr_types::ColourSpace::Srgb)
+    }
+
+    /// TRACES: FR-EXP-2
+    /// Generate the fused shader, encoded to a chosen output space.
+    ///
+    /// Not stored on the graph, because it is not part of the edit: the same
+    /// graph renders to the screen and to a file in the same breath, and the
+    /// two want different answers.
+    pub fn compose_for(&self, output: dr_types::ColourSpace) -> ComposedShader {
+        compose_with_framing(&self.ops, &self.framing, output)
     }
 }