Plug-ins: a filter's read-only objects stay in its input and failed decodes count

A filter run kept a second copy of every read-only object as JSON values.
The run now keeps where each object is in the input, and checks an output
entry against it by parsing that one object, unless the entry is `{"id": …}`
alone.

An image that reaches the decoder now counts toward the 16 MiB pixel total
even when decoding fails, so broken images use up the same total as images
that decode.

The plugin.run text, docs/mcp.md and the progress line state the paint
order and that rule, and docs/plugins.md states that a CMYK image's pixels
are sRGB. New tests cover the per-image 1 MiB, the 16 MiB pixel total and
the 16 MiB text total at and one past their values, memory-budget failures
before the plug-in starts, images that are not decoded, CMYK images
included, and leading per run.

docs/plugins.md

@@ -522,11 +522,12 @@ In this example the character and paragraph styles are cut short; a filter gets
 - An image (`"image"`): `pixelSize` is its width and height in pixels; `colorMode` is `"rgb"`, `"cmyk"`, `"gray"` or
   `"unknown"`, read from the image itself. An embedded image whose pixels take at most 1 MiB in base64 (443 × 443
   pixels fit) has them in `pixelsBase64`: straight RGBA, 8 bits a channel, row by row from the top, and
-  `pixelsOmitted: false`. A CMYK image's pixels are its inks through the working CMYK profile. The pixels of all the
-  images in one input take at most 16 MiB in base64. A larger image, one whose pixels don't fit what the images before
-  it in paint order left, and a linked image (`linked: true`) have
-  `pixelsOmitted: true` and no pixels; the host checks an image's size before it decodes the image. The host never
-  reads a linked image's file for a filter and never gives its path.
+  `pixelsOmitted: false`. A CMYK image's pixels are its inks through the working CMYK profile, as sRGB. The pixels of
+  all the images in one input take at most 16 MiB in base64, and an image the host starts to decode takes its size
+  from those 16 MiB even when decoding fails. A larger image, one whose pixels don't fit what the images before it in
+  paint order left, and a linked image (`linked: true`) have `pixelsOmitted: true` and no pixels; the host checks an
+  image's size before it decodes the image. The host never reads a linked image's file for a filter and never gives
+  its path.
 - A symbol instance (`"symbolInstance"`): `symbolId` is the name of the symbol it shows, with `missing: true` when the
   document has no symbol of that name. `overrides` is `{}`.