fix(r3d): check decode status, validate clip geometry, report errors

[lgritz]

Changes suggeted by a security audit of the R3D reader.

read_frame() ignored the DecodeVideoFrame() status and marked the frame read regardless. On failure the output buffer keeps whatever was there - stale pixels from an earlier frame, or, for the first frame, uninitialized heap from aligned_malloc - and read_native_scanline() copied it out and returned success. Track whether a frame actually decoded and hard-error if not.

The clip width, height and frame count went straight into the ImageSpec and the buffer size math with no range check, and the ImageSpec narrowed them to int while the buffer used the untruncated size_t, so the two could disagree about how big a frame is. Range-check all three, run the spec through check_open() and check_compression_ratio(), and take the buffer size from the validated spec.

If InitializeSdk() failed, the SDK was finalized inside initialize() but open() went on to construct an R3DSDK::Clip against a torn-down SDK, and the destructor finalized a second time. Track the init result and fail open() cleanly.

Every open() failure path returned false with no errorfmt(), so callers got a failure with an empty error message. All of them now report.

Also promote the scanline offset arithmetic to imagesize_t since nchannels * width * y overflows int on a large enough frame.

I could not verify this, since I don't have the R3D SDK. I will need this verified in review.

Assisted-by: Claude Code / claude-opus-5

[lgritz]

@1div0 I would appreciate if you could review and test this, since I don't have the R3D SDK on my end to make it build this file.