♻️[Refactor] Sprint 7 Cross-format Policy Hardening

[maruson08]

Summary

• replace three duplicated cleaning-default/ICC-alias resolvers with one immutable semantic policy while keeping JPEG, WebP, and PNG physical mappings explicit
• make explicit preserveIcc win over deprecated preserveColorProfiles consistently
• omit not-applicable verification concepts and fail closed when metadata-entry limits truncate reporting
• add metadataTruncated: true only to truncated MetadataReport values, independent of diagnostic output
• align ICC classification and cross-format policy invariants without sharing binary writers
• remove unreachable foundation-era NotImplementedError and unused diagnostic codes

Hardening fixes

• activate the dormant TIFF processed-entry counter so maxMetadataEntries bounds a single IFD and linked traversal
• cap normalized public entries across JPEG, WebP, and PNG
• enforce maxDiagnostics during JPEG/WebP/PNG/TIFF emission, report combination, and incomplete-cleaner errors
• preserve WebP structural failure independently from capped diagnostic storage
• preserve existing bounded whole-container removal, unknown/ICC defaults, parser progress, and format-specific reconstruction

Tests

• add one focused cross-format hardening table for policy defaults, deprecated alias precedence, ICC classification, not-applicable verification, entry limits, diagnostic limits, and fail-closed verification
• add direct TIFF single-IFD entry/diagnostic cap regressions
• add WebP suppressed-error structural completeness regression
• retain unique JPEG scan, WebP RIFF/VP8X, PNG CRC/IEND/APNG, and TIFF offset tests
• no existing tests were removed or mechanically consolidated

Validation

• format: pass
• lint: pass
• typecheck: pass
• tests: 222 passed in 22 files (Vitest 1.58s)
• build: pass; 83.03 KB ESM / 10.41 KB declarations
• package dry run: 50.8 kB packed / 269.4 kB unpacked / 7 files
• generated export/runtime review: no test helpers, accidental internal exports, Node dependencies, or platform globals
• npm audit: 0 vulnerabilities
• runtime dependencies: 0; development dependencies: 8