fix(r3d): check decode status, validate clip geometry, report errors - #5413

Changes suggeted by a security audit of the R3D reader.

read_frame() ignored the DecodeVideoFrame() status and marked the frame read
regardless. On failure the output buffer keeps whatever was there - stale
pixels from an earlier frame, or, for the first frame, uninitialized heap
from aligned_malloc - and read_native_scanline() copied it out and returned
success. Track whether a frame actually decoded and hard-error if not.

The clip width, height and frame count went straight into the ImageSpec and
the buffer size math with no range check, and the ImageSpec narrowed them to
int while the buffer used the untruncated size_t, so the two could disagree
about how big a frame is. Range-check all three, run the spec through
check_open() and check_compression_ratio(), and take the buffer size from the
validated spec.

If InitializeSdk() failed, the SDK was finalized inside initialize() but
open() went on to construct an R3DSDK::Clip against a torn-down SDK, and the
destructor finalized a second time. Track the init result and fail open()
cleanly.

Every open() failure path returned false with no errorfmt(), so callers got a
failure with an empty error message. All of them now report.

Also promote the scanline offset arithmetic to imagesize_t;
`nchannels * width * y` overflows int on a large enough frame.

I could not verify this, since I don't have the R3D SDK. I will need
this verified in review.

Assisted-by: Claude Code / claude-opus-5

Signed-off-by: Larry Gritz <lg@larrygritz.com>