Add automatic per-camera color matching at the seam

[RufanMelfor]

Reimplemented from scratch against the current architecture, like the
seam-positioning PR — color_match.rs, blur.wgsl, and
multiband_composite.wgsl from the original design don't exist anywhere
in the current codebase, only the fisheye.wgsl uniform slots they used
to drive (color_scale/color_offset_blend), which are wired but always
hardcoded to identity today.

Periodically samples a coarse grid in the seam-adjacent band of each
camera's raw frame and derives a small, EMA-smoothed, clamped per-camera
YUV offset that nudges both cameras toward their shared mean — same idea
as the original design, reduced in scope (offset only, no separate
multiplicative scale; fixed internal constants for band width/grid/
interval/smoothing rather than individually GUI-tunable knobs).

Sampling-geometry note (full rationale in color_match.rs's module
doc): deliberately reuses the same forward-KB4 primitive and
normalized-intrinsics convention as stitch/geometry.rs's PlaneMap and
fisheye.wgsl's fs_main — not lens::undistorted_to_distorted, which
uses a different (halved-FOV, plane-fitted) intrinsics convention built
for the single-camera undistort preview and would silently sample the
wrong region here. Getting this mapping wrong is a bug class this
feature's own history already hit twice in its prior form.

Correctness note, found via this codebase's own agreement-oracle
tests, not assumed: this codebase treats CPU/GPU render agreement as
load-bearing and test-gated, but color matching is GPU-only (like the
original design's own "no CPU pixel access on BGRA/zero-copy paths"
limitation), with no CPU-executor mirror. Defaulting it on (matching the
original design) silently broke 7 existing agreement tests during
development the moment a source had non-uniform seam-band content —
caught by running the full suite, not shipped. Fixed by defaulting
color_match_enabled to false (opt-in), unlike the original's "on by
default" — a deliberate, documented departure from the original design,
not an oversight.

Wiring: StitchPipeline::set_color_match_enabled → Executor (no-op on
the CPU arm) → StitchCore → StitchSession → StitchJob::color_match()
builder → reco stitch --color-match → reco-gui "Auto color match
(experimental)" checkbox, mirroring show_seam_line's wiring exactly.

Verified: fmt --check clean; cargo test -p reco-core (154 passed,
including 3 new ColorMatchState unit tests proving the correction moves
in the right direction, is symmetric, and converges to the configured
clamp; only the 2 pre-existing CUDA hardware-gap failures, unrelated);
full workspace build clean.

Not included: the multi-band spatial seam blend from the original
design (blur.wgsl/multiband_composite.wgsl, an alternate seam-blend
algorithm) — independent enough from color matching to be its own
follow-up PR rather than bundled here.

[github-actions]

All contributors have signed the CLA. Thank you!
_{Posted by the CLA Assistant Lite bot.}

[RufanMelfor]

I have read the CLA Document and I hereby sign the CLA