fix: add bounds validation for frame metadata regions in parse_spr_header

Validate that secondary frame table and main frame metadata fit within
the input slice before attempting to read them, preventing panics on
truncated .spr data.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

crates/openwa-core/src/render/spr.rs

@@ -117,6 +117,9 @@ pub fn parse_spr_header(data: &[u8]) -> Result<SprHeader, SprError> {
         cursor = align4(cursor + 2);
         secondary_frame_offset = cursor;
         cursor += secondary_frame_count as usize * 12;
+        if data.len() < cursor {
+            return Err(SprError::TooShort { expected: cursor, actual: data.len() });
+        }
     }
 
     // Main frame header (12 bytes)
@@ -147,6 +150,10 @@ pub fn parse_spr_header(data: &[u8]) -> Result<SprHeader, SprError> {
     let frame_meta_offset = align4(cursor);
     let bitmap_offset = frame_meta_offset + frame_count as usize * 12;
 
+    if data.len() < bitmap_offset {
+        return Err(SprError::TooShort { expected: bitmap_offset, actual: data.len() });
+    }
+
     let bitmap_size = if data.len() > bitmap_offset {
         data.len() - bitmap_offset
     } else {