Let a photographer choose the film, and remember which one

The stock model rendered correctly and nothing could ask for it. This is
the picker, and the sidecar key that makes the choice outlive the session.

How the choice persists was the open question, and the answer was already
written down twice in sidecar.rs: `rating` is a top-level key "because a
rating is not an edit", and `masks` are one "because a layer is not a
scalar". A stock is that kind of thing -- a choice of material, not a
number a slider moves -- so it is a top-level key too.

It stores the **id**, not an index. Stocks are files that users add, so an
index would mean installing a profile silently changed which film every
existing photograph had been developed on. A name this build has no
profile for still round-trips untouched, because the alternative is that
syncing to an older phone quietly un-develops the picture.

Only the names travel. Turning one back into tables needs the profile
database, which dr-pipeline deliberately does not link, so `Version::apply`
clears the film and the session re-bakes -- after the parameters, because
the bake reads the film's own exposure sliders and the print balance is
solved against them. That is also why moving those sliders rebuilds the
lookup where no other control in the panel does: an enlarger's filtration
depends on how the negative was exposed.

The panel keeps its rule. It still names no operation and still generates
every control from a declared parameter kind; the stock gets a bespoke
control beside those, exactly as the mask stack does, and for the same
reason. The film's exposure and print exposure arrive as ordinary
generated sliders.

Two defaults worth stating. Picking a colour negative prints it, because
an unprinted one is an orange strip and offering that as the first thing
somebody sees after choosing Portra reads as a bug rather than as a
choice -- the toggle is there for anyone who wants the scan. And a paste
carries no film: a preset is a parameter map, and a stock is not a
parameter, so pasting one would paste a choice the clipboard never took.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

ui/dr-ui/src/library.rs

@@ -399,6 +399,15 @@ pub enum Amendment {
     Settings {
         preset: dr_pipeline::Preset,
         scope: dr_pipeline::Scope,
+        /// TRACES: FR-DEV-3f
+        /// The film stock, when this is an image's own edit being written back.
+        ///
+        /// Two levels of `Option`, and both are load-bearing. The outer says
+        /// whether this write concerns the film at all — a paste does not,
+        /// exactly as it carries no masks. The inner is the choice itself, and
+        /// `Some(None)` is a real edit: "develop this normally again". Without
+        /// the distinction, clearing a film could never be saved.
+        film: Option<Option<dr_pipeline::sidecar::FilmRef>>,
         /// TRACES: FR-DEV-3 | FR-CAT-8
         /// The local adjustments, when this is an image's own edit being
         /// written back rather than a paste onto someone else's.
@@ -636,8 +645,16 @@ fn amend(base: dr_pipeline::Sidecar, w: &SidecarWrite) -> dr_pipeline::Sidecar {
             preset,
             scope,
             masks,
+            film,
         } => {
             preset.amend(&mut version.params, *scope);
+            // TRACES: FR-DEV-3f
+            // Wholesale, like the masks below and for the same reason: this is
+            // the whole of the image's own choice as it stands, so clearing a
+            // film has to leave the sidecar too.
+            if let Some(film) = film {
+                version.film = film.clone();
+            }
             // Replaced wholesale rather than merged: this is the whole of the
             // image's local adjustment stack as it stands, so a layer the user
             // deleted has to leave the sidecar too. Cross-device merging of