Keep the test scene's own arithmetic from overflowing a u64

The first compile this branch ever had. `cargo fmt` reflowed four files
and clippy passed at -D warnings untouched, but one test panicked:
`the_signature_does_not_change_with_scale`, on "attempt to multiply with
overflow".

It is the fixture, not the feature. `scene()`'s little LCG multiplied the
block's y by the golden-ratio constant with a plain `*` while the term
beside it already used `wrapping_mul`, so any scene taller than about 104
pixels overflowed in debug. Only the scale test builds one that large,
which is why 345 of 346 passed around it.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

core/dr-catalog/src/bursts.rs

@@ -609,7 +609,9 @@ pub fn members(conn: &Connection, burst: ImageId) -> Result<Vec<ImageId>, Catalo
           WHERE bm.burst_id = ?1
           ORDER BY i.captured_at ASC, i.id ASC",
     )?;
-    let rows = stmt.query_map([burst.0 as i64], |r| Ok(ImageId(r.get::<_, i64>(0)? as u64)))?;
+    let rows = stmt.query_map([burst.0 as i64], |r| {
+        Ok(ImageId(r.get::<_, i64>(0)? as u64))
+    })?;
     Ok(rows.collect::<Result<Vec<_>, _>>()?)
 }
 
@@ -754,7 +756,7 @@ mod tests {
                 let mut s = seed
                     .wrapping_add(bx as u64)
                     .wrapping_mul(6_364_136_223_846_793_005)
-                    .wrapping_add(by as u64 * 1_442_695_040_888_963_407);
+                    .wrapping_add((by as u64).wrapping_mul(1_442_695_040_888_963_407));
                 s ^= s >> 33;
                 let v = (s % 256) as i32 + brighter;
                 out[y * w + x] = v.clamp(0, 255) as u8;
@@ -836,7 +838,10 @@ mod tests {
         // The top bit is the one at risk: SQLite integers are signed.
         let s = Signature(u64::MAX);
         assert_eq!(Signature::from_stored(s.to_stored()), s);
-        assert_eq!(Signature::from_stored(Signature(0).to_stored()), Signature(0));
+        assert_eq!(
+            Signature::from_stored(Signature(0).to_stored()),
+            Signature(0)
+        );
     }
 
     // ── the grouping ──────────────────────────────────────────────────────
@@ -844,7 +849,11 @@ mod tests {
     #[test]
     fn frames_a_second_apart_and_alike_are_one_burst() {
         let g = group(
-            &[frame(1, 1000, 0xFF00), frame(2, 1001, 0xFF00), frame(3, 1001, 0xFF01)],
+            &[
+                frame(1, 1000, 0xFF00),
+                frame(2, 1001, 0xFF00),
+                frame(3, 1001, 0xFF01),
+            ],
             Rules::default(),
         );
         assert_eq!(g, vec![vec![ImageId(1), ImageId(2), ImageId(3)]]);
@@ -866,10 +875,7 @@ mod tests {
         );
         assert_eq!(
             g,
-            vec![
-                vec![ImageId(1), ImageId(2)],
-                vec![ImageId(3), ImageId(4)],
-            ],
+            vec![vec![ImageId(1), ImageId(2)], vec![ImageId(3), ImageId(4)],],
             "the three-second pause did not end the first burst"
         );
     }
@@ -1109,7 +1115,10 @@ mod tests {
         choose_representative(cat.connection(), ImageId(2)).unwrap();
 
         let m = memberships(cat.connection(), &[ImageId(2)]).unwrap();
-        assert!(m[&ImageId(2)].representative, "the pick did not take effect");
+        assert!(
+            m[&ImageId(2)].representative,
+            "the pick did not take effect"
+        );
 
         regroup(cat.connection(), Rules::default()).unwrap();
         let m = memberships(cat.connection(), &[ImageId(1), ImageId(2)]).unwrap();