Review follow-ups on check_fillable:
- RLE8/RLE4 BMPs skip the density check: an end-of-bitmap code zero-fills the
rest, so a few bytes are a valid picture of any size (check_size still caps it).
Uncompressed BMPs need at least 1 byte per 8 pixels (rows are read in full).
- A GIF's bound counts the first frame's LZW sub-block bytes, not comments or
palettes, at 2731 pixels per byte (a 4096-pixel code takes 12 bits).
- The limits() comment no longer claims it stops the canvas allocation:
DynamicImage::from_decoder allocates without consulting max_alloc.
- whats-new states the 4 MP cutoff.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
