Handle EOF and missing IHDR in PNG decoder

Replace ReadExact with ReadAtLeast to detect EOF and break out of the chunk loop cleanly for truncated/streaming inputs. Stop processing if a chunk length is too large (break instead of throwing). Add an explicit check that IHDR was seen and throw if missing. Rewind idat.Position before calling Reconstruct so the IDAT stream is read from the start.

src/Verify/Compare/Png/PngDecoder.cs

@@ -31,13 +31,17 @@ public static PngImage Decode(Stream stream)
 
         while (true)
         {
-            ReadExact(stream, header);
+            if (stream.ReadAtLeast(header, header.Length, throwOnEndOfStream: false) < header.Length)
+            {
+                break;
+            }
+
             var length = ReadUInt32BigEndian(header);
             var type = ((uint)header[4] << 24) | ((uint)header[5] << 16) | ((uint)header[6] << 8) | header[7];
 
             if (length > int.MaxValue)
             {
-                throw new("PNG chunk too large.");
+                break;
             }
 
             var intLength = (int)length;
@@ -118,6 +122,14 @@ public static PngImage Decode(Stream stream)
 
             ReadExact(stream, crc);
         }
+
+        if (!seenIhdr)
+        {
+            throw new("PNG missing IHDR.");
+        }
+
+        idat.Position = 0;
+        return Reconstruct(idat, width, height, colorType, palette, transparency);
     }
 
     static PngImage Reconstruct(Stream idat, int width, int height, byte colorType, byte[]? palette, byte[]? trns)