fix: harden HEIC decoder FFI boundary

[McanKul]

Summary

• vendor heif-rs 26.7.0 with its Apache-2.0 license so the native decoder boundary can be patched locally
• replace libheif’s deprecated integer-stride plane API with heif_image_get_plane_readonly2
• reject null handles, null decoded images, invalid stride, and pointer/size arithmetic overflow before copying pixels
• keep libheif tile decoding on the calling thread

Why

Two real-device HEIC files reproduce the same Windows 0xc0000005 native access violation in #14. Auditing the complete HEIC call path found no unsafe code in OffPDF itself, but found unchecked pointer/stride assumptions in heif-rs at the libheif FFI boundary.

This closes concrete undefined-behavior risks, but it is intentionally not presented as a confirmed fix until the packaged Windows build is retested with the original device files.

Verification

• cargo test --manifest-path src-tauri/vendor/heif-rs/Cargo.toml --lib — 3 passed
• cargo test --manifest-path src-tauri/Cargo.toml --lib — 96 passed
• npm test — 179 passed
• npm run build — passed
• cargo check --manifest-path src-tauri/Cargo.toml — passed
• cargo xwin check --manifest-path src-tauri/Cargo.toml --target x86_64-pc-windows-msvc — passed after staging normal Windows runtime resources
• 299 isolated decode attempts across the libheif and imazen public HEIC/HEIF corpora — no native process crash

Refs #14