[raiseCatError]

Bounded animated GIF and APNG decoding in the shared graphics service. This prepares for the Welcome Studio's animated logos; nothing calls it yet.

What

New decodeAnimation(bytes, budget?, signal?) in src/graphics/animation.ts:

• GIF:
  • every frame composited, with disposal 0–3 (4–7 treated as none);
  • transparency, local and global palettes, interlace;
  • delays: 0/1 cs → 100 ms, as browsers do;
  • NETSCAPE/ANIMEXTS loop counts reported as total plays (0 = forever).
• APNG:
  • acTL/fcTL/fdAT with strict sequence numbers;
  • the default image counts as a frame only when an fcTL precedes it;
  • dispose none/background/previous; blend source/over with straight alpha;
  • delay_den 0 → 100; delay 0 → 100 ms; delays rounded to whole ms.
• Budgets (default 75 frames, 32 MiB retained RGBA, 5 s):
  • checked before any frame is allocated;
  • later frames are truncated, and truncated: true is set;
  • the first frame is always admitted on time.
• Robustness:
  • an AbortSignal is honoured between chunks, sub-blocks and rows;
  • hostile input only ever yields ImageError.
• Still images return one frame. Animated WebP is reported as unsupported.
• decodeGif and decodePng behave exactly as before. They only export their existing helpers for reuse.

Verification

• Implemented by a delegated agent (Codex) and reviewed independently: no blocker. All 5 should-fix items and the minor items were fixed with regression tests.
• Graphics tests: 113/113 under the T7 storage guard.
• Canonical npm run verify: build and typecheck passed; 4620 tests, 4587 passed, 19 failed, exit 1.
  • The run happened while another workload was loading the machine (load averages ~52–132).
  • All 19 failures are in live shell/tmux tests. None touch graphics code.
  • Rerunning each failing file alone, 10 of 11 files pass.
  • The 11th, liveHardening, fails the same 4 tests on a dev-equivalent worktree in this environment (lsof -t <socket> fails). It is not caused by this change.
• This is not a clean local canonical pass. CI on this head is the independent check.

Not run: physical terminal rendering of animations (no consumer yet).