Let rawler decode a linear DNG wider than 16 700 pixels

rawler's allocation guard is sized in samples but worded in pixels, and
a linear DNG passes width × 3. A 22927 × 8966 Lightroom panorama was
refused as ">50000 px wide", and develop fell back silently to the
embedded preview. Route rawler through third_party with the guard at
1.5 G samples and 200 000 per axis.

third_party/README.md

@@ -68,3 +68,18 @@ Off Android every path is upstream's: the rotation is always `None`.
 Unnecessary once Slint's Skia wgpu surface pre-rotates on its own —
 worth offering upstream, since the linuxkms backend already renders
 through the same rotate-and-translate in `render_to_canvas`.
+
+## rawler 0.7.2 — the allocation guard counts samples, not pixels
+
+`alloc_image_plain!` and `alloc_image_f32_plain!` (`src/pixarray.rs`) panic
+on a buffer over 500 M elements or 50 000 along either axis. The width they
+are handed is `width × samples per pixel`. A linear DNG therefore hits the
+guard at about 16 700 pixels wide, and the 22927 × 8966 panorama
+Lightroom writes is refused as ">50000 px wide". The patch raises the
+guard to 1.5 G samples and 200 000 per axis. It is still a guard against
+a corrupt header, just no longer one that a real photograph trips.
+
+The copy leaves out `data/testdata`, 13 MB of sample files that only the
+crate's own tests read.
+
+Unnecessary once upstream sizes the guard in pixels, or drops it.