fix: restore OpenICE's synthetic grain (§8 dither)

[marcinz606]

Closes #732 (the OpenICE half of it).

The port dropped ICE's LCG dither, reasoning that the ℓ=3 detail band already restores real grain. As @a6o pointed out on the issue, that band restores grain from the pixel itself — under solid dust there is nothing left to restore, so the repair is a plain average of intact neighbours and reads as a smooth patch against film.

What changed

• §8 dither is back: env(x) · (u − ½) · α_ch · x in log density, α = (0.015, 0.015, 0.025), parabolic envelope over [D(⌊0.01M⌋), D(⌊0.99M⌋)], no grain unless x + dither also stays in band. ICE's own constants — they scale with the density being written, so unlike the level constants they transfer across scanners.
• The uniform draw is a hash of the pixel's absolute coordinate, not ICE's frame-global LCG. The LCG is the algorithm's only serial dependency, and it would make the banded pass differ from a whole-frame one.
• ICE's second draw for the never-darken comparison is not reproduced (openICE's own docs call it a bug: it can store a value below the scan).
• The positivity guard still runs on the bare accumulator, and clean film is still passed through bit-identical — grain lands only on pixels the repair rewrites.

Verification

make all green. Measured on samples/scans/20260731_016, high-frequency σ inside the repaired area: 0.0027 without grain → 0.0040 with, against 0.0035 for the film's own grain nearby.

New tests: the dither's envelope, zero mean and band edges; grain reaches a real repair without shifting its level and without touching clean film. Two accuracy tests pin the grain off (the same hook the C reference has as ice_no_dither), since a random per-pixel write floors how close a repair can land to the clean frame.

Docs: docs/PIPELINE.md gains it as step 7 of the OpenICE stage; docs/USER_GUIDE.md notes it under Method → OpenICE.