- page_image_at: PageImage::contains already requires the point inside
visible_rect (rect clipped by the placement clip), so the extra bounds
test before it decided nothing.
- image_dimensions: the 256 MB input-length guard repeated the caller's;
the decoder's max_alloc limit still caps what decoding allocates. Its
test no longer allocates 256 MB to hit that guard.
- font_content_key hashed every font file twice; one 64-bit hash plus the
length is enough to tell duplicate files apart.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>