Fix CodeQL and SonarCloud quality findings

.github/codeql-config.yml

@@ -2,3 +2,10 @@
 # CodeQL configuration for CanvasNet
 
 name: "CanvasNet CodeQL Config"
+
+# Exclude build output directories from analysis - these contain generated
+# files (e.g. XunitAutoGeneratedEntryPoint.cs) that trigger false-positive
+# static analysis findings and are not part of the reviewed source tree.
+paths-ignore:
+  - "**/obj/**"
+  - "**/bin/**"

docs/design/canvas-net/codecs/png-codec.md

@@ -102,11 +102,12 @@ standard filter types) and unpacked into the destination `Surface`'s rows via
 **Throws:**
 
 - `ArgumentNullException` — `stream` is null
-- `InvalidDataException` — missing PNG signature; missing, duplicate, or malformed `IHDR`;
-  unsupported bit depth, color type, compression method, filter method, or interlace method; any
-  chunk's CRC-32 mismatch; a malformed or unsupported zlib header; an Adler-32 checksum mismatch;
-  an unexpected decompressed data length; an unsupported scanline filter type; or the stream ends
-  before all header, chunk, or pixel data has been read
+- `InvalidDataException` — missing PNG signature; missing, duplicate, or malformed `IHDR`; an
+  `IDAT` or `IEND` chunk encountered before `IHDR`; unsupported bit depth, color type, compression
+  method, filter method, or interlace method; any chunk's CRC-32 mismatch; a malformed or
+  unsupported zlib header; an Adler-32 checksum mismatch; an unexpected decompressed data length;
+  an unsupported scanline filter type; or the stream ends before all header, chunk, or pixel data
+  has been read
 
 #### Load(string path)
 

docs/reqstream/canvas-net/codecs.yaml

@@ -196,7 +196,8 @@ sections:
             title: >-
               The Codecs subsystem shall reject malformed or unsupported PNG data (bad signature,
               unsupported color type, unsupported bit depth, interlacing, corrupt chunk CRC-32, corrupt
-              Adler-32 checksum, or a truncated stream) with InvalidDataException.
+              Adler-32 checksum, a chunk preceding IHDR, or a truncated stream) with
+              InvalidDataException.
             justification: |
               Callers must be able to distinguish a genuinely malformed or unsupported PNG file from a
               successful load, and receive a clear, actionable error rather than incorrect pixel data.
@@ -208,6 +209,7 @@ sections:
               - CanvasNet-Codecs-PngCodec-LoadCorruptCrc
               - CanvasNet-Codecs-PngCodec-AdlerValidation
               - CanvasNet-Codecs-PngCodec-LoadTruncatedStream
+              - CanvasNet-Codecs-PngCodec-LoadChunkBeforeIhdr
               - CanvasNet-Codecs-PngCodec-PngSuiteUnsupported
               - CanvasNet-Codecs-PngCodec-PngSuiteCorrupt
             tests:
@@ -219,6 +221,7 @@ sections:
               - PngCodec_Load_CorruptChunkCrc_ThrowsInvalidDataException
               - PngCodec_Load_CorruptAdlerTrailer_ThrowsInvalidDataException
               - PngCodec_Load_TruncatedStream_ThrowsInvalidDataException
+              - PngCodec_Load_IendBeforeIhdr_ThrowsInvalidDataExceptionMentioningIhdr
 
           - id: CanvasNet-Codecs-TiffSave
             title: >-

docs/reqstream/canvas-net/codecs/png-codec.yaml

@@ -205,6 +205,19 @@ sections:
                 tests:
                   - PngCodec_Load_TruncatedStream_ThrowsInvalidDataException
 
+              - id: CanvasNet-Codecs-PngCodec-LoadChunkBeforeIhdr
+                title: >-
+                  The PngCodec class shall reject a PNG stream in which an IDAT or IEND chunk appears
+                  before the mandatory IHDR chunk, with InvalidDataException naming IHDR as the cause.
+                justification: |
+                  IHDR is required by the PNG specification to be the first chunk and supplies the
+                  width, height, and color type every later chunk depends on; encountering IDAT or IEND
+                  first means no header has been parsed, so failing clearly here (rather than decoding
+                  pixel data from default/uninitialized header fields) prevents returning an incorrect
+                  surface.
+                tests:
+                  - PngCodec_Load_IendBeforeIhdr_ThrowsInvalidDataExceptionMentioningIhdr
+
               - id: CanvasNet-Codecs-PngCodec-PngSuiteSupported
                 title: >-
                   The PngCodec class shall successfully load every PngSuite conformance file within its

docs/verification/canvas-net/codecs/png-codec.md

@@ -180,6 +180,14 @@ Builds a valid signature and `IHDR` chunk but omits every chunk that should foll
 `IEND`), and asserts `Load` throws `InvalidDataException` when the stream ends while looking for
 the next chunk.
 
+#### CanvasNet-Codecs-PngCodec-LoadChunkBeforeIhdr: Load Rejects a Chunk Preceding IHDR
+
+**Test**: `PngCodec_Load_IendBeforeIhdr_ThrowsInvalidDataExceptionMentioningIhdr`
+
+Builds a valid signature followed directly by a well-formed `IEND` chunk (correct CRC-32), with
+no `IHDR` chunk present anywhere in the stream, and asserts `Load` throws
+`InvalidDataException` with a message naming `IHDR` as the missing chunk.
+
 #### CanvasNet-Codecs-PngCodec-PngSuiteSupported: PngSuite Files Within Scope Load Successfully
 
 **Test**: `PngCodec_Load_PngSuiteSupportedFile_ReturnsCanvas` (`[Theory]` over 30 PngSuite files)