guard uninitialized count from descr sscanf in npy parser

[soma0212]

load_npy walks a raw cursor through the header dict, and one sscanf can leave that cursor undefined:

• the 'descr' scan reads %c%c%d then a literal closing quote, and only the trailing %n writes the byte count, but %n is not part of sscanf's return value
• a descr missing its closing quote still returns 3, so consumed stays uninitialized and ptr += consumed jumps by a garbage offset that the next read dereferences
• initializing consumed and requiring it to be set rejects the malformed dict instead of advancing the cursor into unmapped memory

Reachable from any .npy opened through load_image; an ASAN build faults inside NpyHeader::parse on a header whose descr drops the quote. Added a regression test that writes such a file and checks the loader returns false.

Checklist

• Tests added or updated (not required for docs, CI config, or typo fixes)
• Documentation updated (if public API changed)
• Python bindings updated (if public API changed)
• Benchmarks are included here if the change is intended to affect performance.
• Commits include AI attribution where applicable (see Code of Conduct)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 70.27%. Comparing base (42a90e8) to head (101ce39).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #9222      +/-   ##
==========================================
+ Coverage   69.92%   70.27%   +0.34%     
==========================================
  Files         255      255              
  Lines       78895    78895              
  Branches    18865    18865              
==========================================
+ Hits        55166    55441     +275     
+ Misses      17928    17822     -106     
+ Partials     5801     5632     -169     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[alexreinking]

@soma0212 — Can you please rebase on main?

[soma0212]

Done, rebased on main. Only conflict was in image_io.cpp against the new read_big_endian_row test; kept both.

[soma0212]

Done, rebased on main. Only conflict was the new read_big_endian_row test landing in the same spot in image_io.cpp; kept both.