✅[Test] Sprint 8 Malformed Corpus and Fuzz Readiness

[maruson08]

Summary

• replaces the small unnamed malformed smoke table with a 50-case named generic/JPEG/WebP/PNG corpus
• adds 17 direct shared-TIFF corruption and traversal cases
• enforces deterministic inspection/cleaning, native-exception containment, typed fail-closed cleaning and verification, input immutability, and diagnostic saturation
• preserves bounded malformed metadata removal and invalid retained PNG CRC bytes
• consolidates 11 row tests into 9 table-driven invariant tests while expanding corruption-family coverage
• documents future property and fuzz targets without adding a dependency or random CI tests
• no parser defects or production behavior changes were required

Issue

Closes #9

Validation

• format: passed (npm run format:check)
• lint: passed (npm run lint)
• typecheck: passed (npm run typecheck)
• tests: 23 files, 220 tests passed in 1.31s (npm test)
• build: passed (npm run build)
• package dry run: 7 files, 50,977 bytes packed, 269,834 bytes unpacked; corpus excluded
• audit: 0 vulnerabilities (npm audit)
• CI: passed in 21s

Scope

• No new format support
• No runtime dependencies
• No random fuzzing in CI