Never crash: render_now refuses an oversize output size too

Review follow-up: the synchronous render_now path checks the output box with
check_output_size like export_job; the hostile-input test covers it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

crates/engine/src/media.rs

@@ -1645,6 +1645,7 @@ impl crate::Session {
 
     /// Synchronous render (CLI, MCP, tests).
     pub fn render_now(&mut self, id: PhotoId, max_w: usize, max_h: usize) -> Result<Rendered, String> {
+        lightcraft_pipeline::check_output_size(max_w, max_h)?;
         let job = self.render_job(id, max_w, max_h, false, true).ok_or("no such photo")?;
         let r = job.run();
         self.accept(&r);

crates/engine/src/tests_export.rs

@@ -1213,4 +1213,6 @@ fn huge_export_size_is_an_error() {
     let huge = usize::MAX >> 8;
     assert!(s.render_export(id, huge, huge, OutputSpace::Srgb, OutputDepth::U8).is_err());
     assert!(s.render_export(id, 70_000, 10, OutputSpace::Srgb, OutputDepth::U8).is_err());
+    assert!(s.render_now(id, huge, huge).is_err());
+    assert!(s.render_now(id, 10, 70_000).is_err());
 }