feat: add max_total_file_pixels, JobOptions, make ExecutionSecurity non_exhaustive

- Add ExecutionSecurity::max_total_file_pixels (Option<u64>, default
  400MP) for bounding total decoded pixels across all animation frames.
- Make ExecutionSecurity #[non_exhaustive] so new fields don't break
  downstream crates. External construction now uses sane_defaults()
  or unspecified() with field mutation.
- Add JobOptions struct (#[non_exhaustive], currently empty) reserved
  for upcoming backend and color management controls.
- Wire JobOptions into Build001Config and Execute001.
- Update all test and tool construction sites.

Author: lilith

imageflow_core/src/clients/stateless.rs

@@ -125,6 +125,7 @@ impl LibClient {
         let send_execute = s::Execute001 {
             framewise: task.framewise,
             security: None,
+            job_options: None,
             graph_recording: task
                 .export_graphs_to
                 .map(|_| s::Build001GraphRecording::debug_defaults()),

imageflow_core/src/context.rs

@@ -647,6 +647,9 @@ impl Context {
         if s.max_json_bytes.is_some() {
             self.security.max_json_bytes = s.max_json_bytes;
         }
+        if s.max_total_file_pixels.is_some() {
+            self.security.max_total_file_pixels = s.max_total_file_pixels;
+        }
     }
 
     /// For executing an operation graph (assumes you have already configured the context with IO sources/destinations as needed)
@@ -860,6 +863,7 @@ fn test_take_after_encode_returns_data() {
     let execute = s::Execute001 {
         graph_recording: Some(s::Build001GraphRecording::off()),
         security: None,
+        job_options: None,
         framewise: s::Framewise::Steps(vec![
             s::Node::Decode { io_id: 0, commands: None },
             s::Node::Encode {
@@ -896,6 +900,7 @@ fn test_get_ptr_after_encode_then_take_blocked() {
     let execute = s::Execute001 {
         graph_recording: Some(s::Build001GraphRecording::off()),
         security: None,
+        job_options: None,
         framewise: s::Framewise::Steps(vec![
             s::Node::Decode { io_id: 0, commands: None },
             s::Node::Encode {
@@ -940,7 +945,7 @@ impl Drop for Context {
 #[test]
 fn test_context_size() {
     eprintln!("std::mem::sizeof(Context) = {}", std::mem::size_of::<Context>());
-    assert!(std::mem::size_of::<Context>() < 380);
+    assert!(std::mem::size_of::<Context>() < 400);
 }
 
 #[test]
@@ -975,10 +980,10 @@ fn test_calculate_context_heap_size() {
     // Fail if this grows so we can notice it
     // Windows has larger RwLock/Mutex, so allow a few extra bytes
     assert!(context_allocs <= 6);
-    assert!(context_bytes <= 1024);
+    assert!(context_bytes <= 1056);
 
     assert!(context_allocs <= 6);
-    assert!(thread_safe_bytes <= 1216);
+    assert!(thread_safe_bytes <= 1248);
 }
 
 #[test]

imageflow_core/src/json/endpoints/mod.rs

@@ -145,12 +145,7 @@ fn test_handler() {
     ];
 
     let build = Build001 {
-        builder_config: Some(Build001Config {
-            graph_recording: None,
-            security: None,
-            //            process_all_gif_frames: Some(false),
-            //            enable_jpeg_block_scaling: Some(false)
-        }),
+        builder_config: Some(Build001Config::default()),
         io: vec![input_io, output_io],
         framewise: Framewise::Steps(steps),
     };

imageflow_core/src/json/endpoints/openapi_schema_v1.json

@@ -617,6 +617,16 @@
               }
             ]
           },
+          "job_options": {
+            "oneOf": [
+              {
+                "type": "null"
+              },
+              {
+                "$ref": "#/components/schemas/JobOptions"
+              }
+            ]
+          },
           "security": {
             "oneOf": [
               {
@@ -1532,6 +1542,16 @@
               }
             ]
           },
+          "job_options": {
+            "oneOf": [
+              {
+                "type": "null"
+              },
+              {
+                "$ref": "#/components/schemas/JobOptions"
+              }
+            ]
+          },
           "security": {
             "oneOf": [
               {
@@ -1603,6 +1623,15 @@
             ],
             "description": "Maximum bytes for a JSON API payload before deserialization.\nDefault: 64 MB. Set to `None` to disable.",
             "minimum": 0
+          },
+          "max_total_file_pixels": {
+            "type": [
+              "integer",
+              "null"
+            ],
+            "format": "int64",
+            "description": "Maximum total decoded pixels across all frames in a file.\nFor animation, this is checked as frame_count * width * height.\nDefault: 400 megapixels. Set to `None` to disable.",
+            "minimum": 0
           }
         }
       },
@@ -1949,6 +1978,10 @@
           }
         }
       },
+      "JobOptions": {
+        "type": "object",
+        "description": "Reserved for future options controlling backends, color management,\nand other job-level behavior. Currently empty."
+      },
       "JobResult": {
         "type": "object",
         "required": [

imageflow_core/src/json/endpoints/openapi_schema_v1.json.hash

@@ -1 +1 @@
-526a58cce7aa8a9b5a4149d9f00b1211
+8da8d9f74761cd780b80ee05e81c2c9e

imageflow_core/src/json/endpoints/v1.rs

@@ -717,12 +717,7 @@ fn test_handler() {
     ];
 
     let build = Build001 {
-        builder_config: Some(Build001Config {
-            graph_recording: None,
-            security: None,
-            //            process_all_gif_frames: Some(false),
-            //            enable_jpeg_block_scaling: Some(false)
-        }),
+        builder_config: Some(Build001Config::default()),
         io: vec![input_io, output_io],
         framewise: Framewise::Steps(steps),
     };

imageflow_core/tests/integration/cms_diagnostic.rs

@@ -45,6 +45,7 @@ fn cms_cmyk_backend_divergence() {
     ctx.add_output_buffer(1).unwrap();
 
     let execute = s::Execute001 {
+        job_options: None,
         graph_recording: Some(s::Build001GraphRecording::off()),
         security: None,
         framewise: s::Framewise::Steps(vec![
@@ -88,6 +89,7 @@ fn cms_dual_backend_regression() {
         ctx.add_output_buffer(1).unwrap();
 
         let execute = s::Execute001 {
+            job_options: None,
             graph_recording: Some(s::Build001GraphRecording::off()),
             security: None,
             framewise: s::Framewise::Steps(vec![

imageflow_core/tests/integration/color_conversion.rs

@@ -859,6 +859,7 @@ fn test_matte_compositing_no_double_division() {
     ctx.add_input_vector(0, png_bytes).unwrap();
     ctx.add_output_buffer(1).unwrap();
     let execute = imageflow_types::Execute001 {
+        job_options: None,
         graph_recording: None,
         security: None,
         framewise: imageflow_types::Framewise::Steps(steps),
@@ -878,6 +879,7 @@ fn test_matte_compositing_no_double_division() {
         },
     ];
     let execute2 = imageflow_types::Execute001 {
+        job_options: None,
         graph_recording: None,
         security: None,
         framewise: imageflow_types::Framewise::Steps(decode_steps),
@@ -1020,6 +1022,7 @@ fn test_matte_compositing_fully_transparent_pixels() {
     ctx.add_input_vector(0, png_bytes).unwrap();
     ctx.add_output_buffer(1).unwrap();
     let execute = imageflow_types::Execute001 {
+        job_options: None,
         graph_recording: None,
         security: None,
         framewise: imageflow_types::Framewise::Steps(steps),
@@ -1124,6 +1127,7 @@ fn test_matte_compositing_mixed_alpha() {
     ctx.add_input_vector(0, png_bytes).unwrap();
     ctx.add_output_buffer(1).unwrap();
     let execute = imageflow_types::Execute001 {
+        job_options: None,
         graph_recording: None,
         security: None,
         framewise: imageflow_types::Framewise::Steps(steps),

imageflow_core/tests/integration/common/mod.rs

@@ -219,8 +219,12 @@ pub fn build_framewise(
     for (ix, val) in io.into_iter().enumerate() {
         IoTestTranslator {}.add(context, ix as i32, val)?;
     }
-    let build =
-        s::Execute001 { security, graph_recording: default_graph_recording(debug), framewise };
+    let build = s::Execute001 {
+        job_options: None,
+        security,
+        graph_recording: default_graph_recording(debug),
+        framewise,
+    };
     if debug {
         println!("{}", serde_json::to_string_pretty(&build).unwrap());
     }
@@ -315,6 +319,7 @@ pub fn decode_image(c: &mut Context, io_id: i32) -> BitmapKey {
 fn try_decode_image(c: &mut Context, io_id: i32) -> Option<BitmapKey> {
     let capture_id = 0;
     let result = c.execute_1(s::Execute001 {
+        job_options: None,
         graph_recording: None,
         security: None,
         framewise: s::Framewise::Steps(vec![

imageflow_core/tests/integration/encoders.rs

@@ -202,6 +202,7 @@ pub fn compare_encoded_to_source(
     let input_copy = input.clone();
 
     let execute = s::Execute001 {
+        job_options: None,
         graph_recording: default_graph_recording(debug),
         security: None,
         framewise: s::Framewise::Steps(steps),