Implement the vanilla Aquifer; stop flooding caves

Every air block below y=63 was turned into water. That is one line of code and
it cost the entire underground: no dry caves, no lava lakes, no air pockets, a
solid block of water from the sea floor to bedrock.

Vanilla decides fluid per position instead. Aquifer centres sit on a jittered
16x12x16 grid; each gets a fluid level and type from the floodedness and spread
noises, with centres near open sky inheriting the sea and buried ones getting a
much lower randomised level or nothing at all. A position takes its nearest
centre's fluid unless the barrier noise raises enough pressure between the two
or three nearest centres to seal it back to stone. Deep centres turn to lava.

Porting it means fixing the order of generation, not just adding a file. Vanilla
resolves stone/water/lava/air during the density pass and only then runs the
surface rules over a finished column; we did it the other way round, which is
what forced the unconditional flood in the first place. fillVanillaColumn now
asks the aquifer per position, and applySurfaceRule walks the finished column
carrying the bookkeeping SurfaceSystem carries: air resets the counters, a fluid
records its water height, and stone gets a depth from the top of its run plus
one from the bottom, found by looking ahead to the next non-stone block below.

That last one fixes stone_depth's ceiling form, which had no bottom-up depth to
work with and was testing the top-down one instead -- fourteen rules in the
overworld tree use it to dress cave roofs. The floor form is unchanged: vanilla
counts from 1 and compares against 1 + offset, we counted from 0 and compared
against offset.

The aquifer grid is built eagerly per chunk rather than lazily, because our
columns fill concurrently; every cell is a pure function of its grid coordinate
and every cell in the computed range gets consulted anyway. Cost is ~0.5% of
chunk generation, most of it absorbed by the shared preliminary-surface cache.

Inland caves go from 100% water to 3.8%, and lava exists for the first time.
cmd/gendump grows a census that would have failed loudly before, and
TestCavesAreDry guards it in the suite.

cmd/gendump/main.go

@@ -142,6 +142,75 @@ func main() {
 	}
 
 
+	// Caves are dry: the aquifer decides fluid per position, so the open volume
+	// underground is overwhelmingly air, with occasional aquifer pools and lava
+	// down low. The defect this catches is the old unconditional "flood every
+	// air block below sea level" pass, under which this number was 100%.
+	fmt.Println("\n=== Underground fluids: water fraction y=-50..40 over inland chunks, lava anywhere ===")
+	air, water, lava, solidU := 0, 0, 0, 0
+	deepLava := 0
+	inland := 0
+	for cx := int32(-12); cx <= 12; cx += 4 {
+		for cz := int32(-12); cz <= 12; cz += 4 {
+			ch := gen(cx, cz)
+			// Lava is counted everywhere; the water fraction only over land,
+			// since an ocean's water legitimately reaches its floor. Lava
+			// pockets cluster, so a narrow sample can miss them entirely.
+			land := isInland(ch)
+			if land {
+				inland++
+			}
+			for wy := world.MinY; wy <= 40; wy++ {
+				// The water fraction is measured over y=-50..40, above the band
+				// where the global fluid rule makes lava unconditional.
+				census := land && wy >= -50
+				for lx := 0; lx < 16; lx++ {
+					for lz := 0; lz < 16; lz++ {
+						switch ch.GetBlock(lx, wy, lz) {
+						case world.StateAir:
+							if census {
+								air++
+							}
+						case world.StateWater:
+							if census {
+								water++
+							}
+						case world.StateLava:
+							lava++
+							if wy < -54 {
+								deepLava++
+							}
+							if census {
+								air++ // open volume, just not water
+							}
+						default:
+							if census {
+								solidU++
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	open := air + water
+	fmt.Printf("  chunks=%d solid=%d open=%d (air+lava=%d water=%d) | lava total=%d, of it below y=-54: %d\n",
+		inland, solidU, open, air, water, lava, deepLava)
+	switch {
+	case open == 0:
+		fmt.Println("  FAIL: no open volume underground at all")
+	default:
+		frac := float64(water) / float64(open)
+		fmt.Printf("  water is %.1f%% of the open volume\n", frac*100)
+		if frac > 0.35 {
+			fmt.Println("  FAIL: caves are flooded; the aquifer is not deciding fluid")
+		} else if lava == 0 {
+			fmt.Println("  FAIL: no lava anywhere underground")
+		} else {
+			fmt.Println("  OK: caves are dry and lava exists")
+		}
+	}
+
 	// Subsurface banding: find grass-topped land columns and print the top ~8
 	// blocks (grass cap → dirt band → stone) to confirm surfaceDepth widened the
 	// dirt band beyond a single block.
@@ -188,6 +257,28 @@ func loadName(od *worldgen.OverworldDensity, s2 worldgen.Sample2D, wx, wz int) s
 	return world.BiomeNameAt(od, wx, wz)
 }
 
+// isInland reports whether most of the chunk's columns break the surface above
+// sea level. Ocean chunks are excluded from the cave-fluid census because their
+// water legitimately reaches all the way down to the sea floor.
+func isInland(c *world.Chunk) bool {
+	aboveSea := 0
+	for lx := 0; lx < 16; lx += 2 {
+		for lz := 0; lz < 16; lz += 2 {
+			for wy := world.MinY + world.WorldHeight - 1; wy >= world.MinY; wy-- {
+				b := c.GetBlock(lx, wy, lz)
+				if b == world.StateAir {
+					continue
+				}
+				if b != world.StateWater && wy >= world.SeaLevel {
+					aboveSea++
+				}
+				break
+			}
+		}
+	}
+	return aboveSea > 48 // of 64 sampled columns
+}
+
 func crossSection(c *world.Chunk) {
 	// vertical band from y=40..136
 	for wy := 130; wy >= 40; wy-- {
@@ -205,6 +296,8 @@ func glyph(b uint16) string {
 		return "."
 	case world.StateWater:
 		return "~"
+	case world.StateLava:
+		return "!"
 	case world.StateStone:
 		return "#"
 	case world.StateDirt: