reject unsupported bit depths in load_png

[soma0212]

load_png picks the row reader from bit depth without checking it is one the loader actually supports:

• libpng reports bit_depth 1/2/4 for sub-byte grayscale and palette PNGs and keeps a packed row, so png_get_rowbytes() is only ceil(width*bit_depth/8) bytes
• anything that is not 8-bit takes the read_big_endian_row<uint16_t> path, which reads 2 bytes per pixel past the packed row buffer and stores 16-bit samples into a buffer whose element size is 1 byte for the 1-bit halide type
• reachable from any caller that loads an untrusted PNG; ASAN flags a heap-buffer-overflow read in read_big_endian on a 1-bit file

Reject bit depths other than 8 or 16 up front, which is what query_png() already advertises, so valid 8- and 16-bit files are unchanged. Added a regression test that writes a 1-bit PNG and checks the load returns false instead of running off the row.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@d3b5a85). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9229   +/-   ##
=======================================
  Coverage        ?   70.30%           
=======================================
  Files           ?      255           
  Lines           ?    78936           
  Branches        ?    18881           
=======================================
  Hits            ?    55498           
  Misses          ?    17868           
  Partials        ?     5570           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.