Implement the vanilla Aquifer; stop flooding caves

Every air block below y=63 was turned into water. That is one line of code and
it cost the entire underground: no dry caves, no lava lakes, no air pockets, a
solid block of water from the sea floor to bedrock.

Vanilla decides fluid per position instead. Aquifer centres sit on a jittered
16x12x16 grid; each gets a fluid level and type from the floodedness and spread
noises, with centres near open sky inheriting the sea and buried ones getting a
much lower randomised level or nothing at all. A position takes its nearest
centre's fluid unless the barrier noise raises enough pressure between the two
or three nearest centres to seal it back to stone. Deep centres turn to lava.

Porting it means fixing the order of generation, not just adding a file. Vanilla
resolves stone/water/lava/air during the density pass and only then runs the
surface rules over a finished column; we did it the other way round, which is
what forced the unconditional flood in the first place. fillVanillaColumn now
asks the aquifer per position, and applySurfaceRule walks the finished column
carrying the bookkeeping SurfaceSystem carries: air resets the counters, a fluid
records its water height, and stone gets a depth from the top of its run plus
one from the bottom, found by looking ahead to the next non-stone block below.

That last one fixes stone_depth's ceiling form, which had no bottom-up depth to
work with and was testing the top-down one instead -- fourteen rules in the
overworld tree use it to dress cave roofs. The floor form is unchanged: vanilla
counts from 1 and compares against 1 + offset, we counted from 0 and compared
against offset.

The aquifer grid is built eagerly per chunk rather than lazily, because our
columns fill concurrently; every cell is a pure function of its grid coordinate
and every cell in the computed range gets consulted anyway. Cost is ~0.5% of
chunk generation, most of it absorbed by the shared preliminary-surface cache.

Inland caves go from 100% water to 3.8%, and lava exists for the first time.
cmd/gendump grows a census that would have failed loudly before, and
TestCavesAreDry guards it in the suite.

internal/world/aquifer_verify_test.go

@@ -0,0 +1,112 @@
+package world
+
+import "testing"
+
+// TestCavesAreDry is the load-bearing check for the aquifer. Before it landed,
+// every air block below sea level was turned into water unconditionally, so
+// every cave under y=63 was a solid block of water and no lava existed
+// anywhere. The aquifer decides fluid per position instead, and the visible
+// consequence is that inland caves are overwhelmingly air.
+//
+// The thresholds are deliberately loose — this is a regression guard against
+// the whole underground filling up again, not a parity check.
+func TestCavesAreDry(t *testing.T) {
+	gen := NewVanillaGenerator(12345)
+	air, water, lava := 0, 0, 0
+	inland := 0
+	// A wide grid rather than a handful of chunks: lava pockets are clustered,
+	// so a small sample can legitimately contain none.
+	for cx := int32(-12); cx <= 12; cx += 4 {
+		for cz := int32(-12); cz <= 12; cz += 4 {
+			ch := gen(cx, cz)
+			if ch == nil {
+				continue
+			}
+			// Lava counts everywhere; the water fraction only over land, since
+			// an ocean's water legitimately reaches its floor.
+			land := inlandChunk(ch)
+			if land {
+				inland++
+			}
+			for wy := MinY; wy <= 40; wy++ {
+				census := land && wy >= -50
+				for lx := 0; lx < 16; lx++ {
+					for lz := 0; lz < 16; lz++ {
+						switch ch.GetBlock(lx, wy, lz) {
+						case StateAir:
+							if census {
+								air++
+							}
+						case StateWater:
+							if census {
+								water++
+							}
+						case StateLava:
+							lava++
+							if census {
+								air++
+							}
+						}
+					}
+				}
+			}
+		}
+	}
+	if inland == 0 {
+		t.Skip("no inland chunks in the scanned area")
+	}
+	open := air + water
+	if open == 0 {
+		t.Fatalf("no open volume underground across %d inland chunks", inland)
+	}
+	frac := float64(water) / float64(open)
+	t.Logf("inland chunks=%d open=%d water=%d (%.1f%%) lava=%d", inland, open, water, frac*100, lava)
+	if frac > 0.35 {
+		t.Errorf("water is %.1f%% of the open volume below ground; caves are flooded", frac*100)
+	}
+	if lava == 0 {
+		t.Error("no lava underground: the aquifer never picks a lava fluid type")
+	}
+}
+
+// TestNoFluidUnderBedrock guards the world floor: the aquifer runs all the way
+// down, and a fluid level reaching below y=-59 would put water or lava inside
+// the bedrock band.
+func TestNoFluidUnderBedrock(t *testing.T) {
+	gen := NewVanillaGenerator(12345)
+	for _, p := range [][2]int32{{0, 0}, {5, -7}, {-13, 21}} {
+		ch := gen(p[0], p[1])
+		for wy := MinY; wy <= MinY+5; wy++ {
+			for lx := 0; lx < 16; lx++ {
+				for lz := 0; lz < 16; lz++ {
+					switch b := ch.GetBlock(lx, wy, lz); b {
+					case StateAir, StateWater, StateLava:
+						t.Fatalf("chunk(%d,%d) block %d at (%d,%d,%d) inside the bedrock band", p[0], p[1], b, lx, wy, lz)
+					}
+				}
+			}
+		}
+	}
+}
+
+// inlandChunk reports whether most of the chunk breaks the surface above sea
+// level. Ocean chunks are excluded from the cave census: their water reaches
+// the sea floor legitimately.
+func inlandChunk(c *Chunk) bool {
+	aboveSea := 0
+	for lx := 0; lx < 16; lx += 2 {
+		for lz := 0; lz < 16; lz += 2 {
+			for wy := MinY + WorldHeight - 1; wy >= MinY; wy-- {
+				b := c.GetBlock(lx, wy, lz)
+				if b == StateAir {
+					continue
+				}
+				if b != StateWater && wy >= SeaLevel {
+					aboveSea++
+				}
+				break
+			}
+		}
+	}
+	return aboveSea > 48 // of 64 sampled columns
+}