Run the app's hot-pixel pass alone, and dump through it

The learned demosaic replaces the classical one and takes its input, the
mosaic hot_pixels.wgsl leaves (denoise.md §2), so its training data and its
input in the app must come through that pass and not a lookalike. The pass
was recorded inline in Demosaicer::run; it is now built by hot_pass and
recorded by record_hot_pass, which run still uses unchanged, and
Demosaicer::repair_hot_pixels runs it on its own and reads the mosaic back.

mosaic_dump moves to dr-gpu to call it, records how many photosites changed,
and keeps --unrepaired for a raw readout.

core/dr-gpu/tests/hot_pixels.rs

@@ -140,3 +140,33 @@ fn a_hot_photosite_on_x_trans_is_invisible() {
     let diff = worst(&clean, &hot);
     assert!(diff <= 1, "a hot X-Trans photosite still shows, by {diff}");
 }
+
+/// The repair alone, read back (FR-DEV-3g): the learned demosaic takes the
+/// mosaic this pass leaves, so it must be the same pass and nothing more —
+/// the hot photosite replaced, a real highlight and every other photosite
+/// untouched.
+#[test]
+fn the_repaired_mosaic_reads_back_with_only_the_defect_changed() {
+    let Some(ctx) = ctx() else {
+        eprintln!("no GPU adapter; skipping");
+        return;
+    };
+    let d = Demosaicer::new(&ctx).expect("demosaicer");
+    let mut star = vec![(MIDDLE, MIDDLE, WHITE)];
+    for dy in 0..3 {
+        for dx in 0..3 {
+            star.push((4 + dx, 4 + dy, WHITE));
+        }
+    }
+    let before = frame(CfaPattern::Rggb, 40, &star);
+    let mut raw = before.clone();
+    let changed = d.repair_hot_pixels(&mut raw).expect("repair");
+    assert_eq!(changed, 1, "only the lone hot photosite should change");
+    let at = (MIDDLE * SIZE + MIDDLE) as usize;
+    assert_eq!(
+        raw.data[at], 40,
+        "repaired to its brightest same-colour neighbour"
+    );
+    let others = (0..raw.data.len()).filter(|&i| i != at);
+    assert!(others.into_iter().all(|i| raw.data[i] == before.data[i]));
+}