fix: close remaining detector-image handles through one loader

[D-sudoasd]

Problem

Architecture, CHANGELOG, and the Workbench known-boundary notes still said FabIO handles were closed only in the strict 1D readers and the 2D resume verifier. The shared reference loader, strict 2D main read, integrate1d mask/EDF paths, and many Workbench fabio.open sites each had their own (or no) close path. On Windows that leaks file handles.

Cause

There was no shared copy-and-close helper at the I/O edge, so each caller opened FabIO directly and often dropped the handle after reading .data.

Fix

• Add saxsabs.io.detector_images as the common copy-and-close loader (owned pixel copy, copied header, close on success and failure).
• Route Workbench, shared-reference, bl19b2.read_detector_image, integrate1d mask/EDF, and the 2D resume verifier through it.
• Workbench optional .npy mask/flat loads now use allow_pickle=False.
• Intensity-state / absolute-buffer / K-only / writer-unit fail-closed contracts are unchanged.

How verified

Command	Exit
git diff --check	0
git diff --cached --check	0
python -m ruff check src tests	0
python -m pytest -q	0 (747 passed)
python -m saxsabs --version (twice)	0, saxsabs 2.0.0
python -m saxsabs estimate-k --meas examples/k_measured.csv --ref examples/k_reference.csv (twice)	0, k_factor 2.0 both runs
python examples/minimal_2d/run_minimal_2d_pipeline.py (twice)	0, planted-K relative error 0.001933697... both runs

Head: 25d41961aa6bcf7735cbd0ca1a6cbddb5744a442