Write out the derivation behind every kernel width these tests assert

A test that cannot be run cannot be checked by running it, and a number
copied out of a test run agrees with whatever the code did on the day.
Each asserted kernel width, tolerance and overshoot bound now carries the
arithmetic that produces it -- the shorter edge, the sigma, the
truncation at two sigmas, and where the rounding falls -- so a reader can
verify the expectation against the recipe without a GPU or a compiler.

Also records the two places where a bound is a bound and not a
measurement: the tolerance in the frame-fraction test is exactly what
rounding a kernel to a whole pixel costs on the smallest frame it uses,
and the halo test's floor and ceiling bracket a peak derived from the
step, the soft limit and the midtone taper rather than from a run.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

core/dr-gpu/tests/local_contrast.rs

@@ -216,6 +216,19 @@ fn the_soft_limit_bounds_the_halo_at_a_hard_edge() {
         .fold(0.0f32, f32::max);
     let bound = Clarity::with_amount(100.0).overshoot_bound();
 
+    // Where the two comparisons below sit, derived rather than observed:
+    //
+    //   srgb_decode(175) = 0.4287, srgb_decode(90) = 0.1022
+    //   the step is log2(0.4287 / 0.1022)     = 2.069 stops
+    //   an unlimited mask peaks at half of it = 1.034 stops
+    //   the soft limit saturates at           = 0.350 stops  (`bound`)
+    //   the midtone taper then takes about 13% off at 175, so the peak this
+    //   test should actually see is near      = 0.30  stops
+    //
+    // So 0.30 has to clear the 0.1 floor with room, and fall well under both
+    // 0.35 + slack and 0.6 × 1.034 = 0.62. Every one of those is a bound with
+    // a reason, not a tolerance widened until the test passed.
+    //
     // A code value's worth of slack: the readback is 8-bit, and a pixel
     // sitting exactly on the bound quantises either side of it.
     assert!(