rex3: CIDMATCH is a mask of permitted CIDs, not an equality value

[iblowmymind]

Problem

REX3 CLIPMODE bits 12:9 (CIDMATCH) are a four-bit permission mask: bit N permits a framebuffer write to a destination pixel whose two-bit CID is N (0000 rejects every write, 1111 permits all). See docs/rex3.pdf, table 16 and section 3.3.

Both the interpreter and the REX JIT treated the field as an equality value and compared it against AUX's low nibble, which also includes the popup bits. That rejected legitimate writes. It showed up as drawing artifacts in StudioPaint: the captured CLIPMODE was 0x00000403 (mask 0010, i.e. CID 1), and the destination AUX byte was 0x11 (CID 1), yet the write was dropped.

Disabling the REX JIT did not help, because the interpreter had the same bug. Its screen-to-screen copy path also skipped the destination CID check entirely.

Change

• src/rex3.rs: a cid_allows_write helper implements the mask check. Pixel draws and screen-to-screen copies both use it; the copy path checks the destination.
• src/rex3_jit/compiler.rs: the emitted check for block draws and integer lines now tests (mask >> cid) & 1, using only AUX bits 1:0.
• Framebuffer reads remain unchecked, as before.

Tests

• New: cid_write_masks_interpreter and cid_write_masks_jit cover every mask × CID × popup value for block draws, integer lines and screen-to-screen copies. The JIT variant checks jit_go_count, so an interpreter fallback can't make it pass.
• Existing tests: rex3init now uses mask 1111 rather than 0000 (under the correct semantics, 0000 rejects everything), and explicit JIT compile requests use that CLIPMODE key.

cargo test --release --features rex-jit --lib -- rex3

Docs: docs/rex3.md CIDMATCH description corrected; new note rules/rex3/cidmatch-is-a-mask.md.