* plate-test: bound text sampling, image size, resource depth and plate bytes
- judge: sample text regions over integer pixel ranges clipped to the plate,
so a huge or NaN region cannot stall the float counter.
- reference: the writer enforces the scene validator's image pixel cap
(MAX_IMAGE_PX, shared with scene.rs) before generating pixels.
- structure: Walk::content follows nested Form/pattern/soft-mask resources
at most MAX_RESOURCE_DEPTH (16) levels deep.
- tiff: a plate may hold at most MAX_PLATE_PIXELS (1 GiB) and its buffer is
reserved fallibly.
* address review: report resource-depth truncation as an error; re-expand shared streams reached shallower
* address review: list shared groups and graphics states once; accept empty terminal Resources