Membrane clone sampled the source patch and boundary points raw, so a speck
inside the source band got copied straight into the healed area.

Two-layer fix, mirrored on CPU (numba) and GPU (WGSL):
- Clone-sample guard: every cloned sample (source patch, both boundary
  sides) whose luma pops above its 3x3 luma-median neighbour by 0.06 is a
  speck — the median-luma pixel is used instead (a real pixel, grain kept).
  Ceiling: specks wider than ~2px fill the window and pass through.
- Source scoring now probes the candidate patch interior (chain + inner
  ring) and heavily penalizes lumas above the candidate band's median, so
  dusty patches lose to clean ones upfront — rim-band SSD alone could not
  see interior dust.

…apsule

The manual heal replaced the entire brushed capsule with shifted source
texture, which read as cloning a bigger area than selected and could still
drag a large speck along. The brush is now a search area:

- Destination dust gate (CPU + WGSL): a brushed pixel is healed only when
  its luma exceeds the membrane-predicted clean value (smoothstep 0.04-0.12,
  encoded domain). Clean pixels inside the brush stay untouched.
- The directly-cloned source sample upgrades from a 3x3 to a 5x5 luma-median
  guard, catching specks up to ~4px that slipped through before; boundary
  samples keep the cheaper 3x3.

The pipeline treated brush size as a radius while the overlay cursor draws
size/(2*preview_render_size) — half of it — so the healed area was 2x the
visible circle. Brush size is now a diameter everywhere: pipeline radius is
size/2 * scale_factor, matching overlay._brush_screen_radius 1:1 at any
zoom and resolution (the source-offset scoring radius in the controller
follows the same convention).

Locked in by tests: a dust strip crossing the brush is healed strictly
inside the brush circle (max changed-pixel distance <= radius, strip
untouched outside), and the pipeline radius fraction equals the cursor
fraction exactly.

Pure formatting (AST-identical): line joins/splits and blank-line removal
from a ruff format pass; no behavior change.

Same behaviour as double-click: Enter commits an in-progress scratch stroke
or closes a lasso polygon (only when it has >= 3 vertices — fewer keeps the
draw alive instead of wiping it). The overlay now takes click focus so its
widget-context shortcuts (Esc cancel, Enter finish) actually fire after the
user clicks the canvas; without a focus policy they never could.