fix(android): isolate capture buffers and encode the actual bitmap size

[OskarEichler]

Fixes

Use per-worker reusable output buffers so concurrent captures cannot overwrite each other; close raw-file streams and Deflaters on failure; write resized RAW dimensions/bytes; reject failed bitmap compression; report the WebP MIME type for the legacy webm alias. Remove the unused preallocation stream.

Compatibility / observable changes

RAW resize results now carry dimensions matching their pixel payload. The deprecated webm alias still encodes WebP, now with the correct data URI MIME. Failed encoding rejects instead of returning an empty success. Existing PNG/JPEG/WebP output formats and native dependency versions are unchanged.

Verification

Compiled actual Java methods reproduce cross-worker byte corruption, resource leaks, resize failures and incorrect MIME. Real zlib round-trip control passes. Native bitmap/bridge behavior is modeled with doubles; existing Android unit suite and example build also pass.

This patch was applied independently to upstream commit 6acbec50a5e3cab7d668711d757c52cfdc791c76 and passed its targeted external actual-source diagnostics. Across the focused patches, 119 such checks pass. Java/Objective-C diagnostics use controlled bridge/platform doubles or owned filesystem fixtures; they are not substitutes for physical-device rendering tests.

Combined branch checks:

• Existing JS suite: 4 suites, 46 tests pass.
• TypeScript, ESLint (zero warnings), full Prettier check and library build pass.
• Existing Android unit suite: 62 tests pass; Android Debug example build passes.
• Existing Windows managed helper suite: 16 tests pass on .NET 8.
• Unsigned iOS Simulator example build passes. Native tests: 13/14 pass; the one intentional old-behavior assertion conflict is described below.
• Android and iOS production Metro bundles pass. Web production build passes with three bundle-size warnings.
• React 18.3.1: all 21 applicable JS diagnostic controls pass; React 19 includes callback-ref cleanup coverage.

The separate iOS cleanup patch intentionally makes the existing test named testReleaseCapture_currentlyDeletesPrefixOnlyImposterDirectories_KNOWN_LOOSE_GUARD fail because it asserts the unsafe old behavior. That patch is kept in a separate draft PR. No checked-in test/spec or snapshot files were added, modified, regenerated or disabled.

Windows/Expo native builds, physical-device video/PixelCopy output, and full Detox suites were not run. The full unchanged Playwright suite was run against both baseline and patched builds: both have 9 passes and the same 3 failures. Two Linux-reference screenshot mismatches have byte-identical baseline/patched actual images on macOS. The CORS fixture hard-codes port 3000, occupied by an unrelated local backend; the isolated example uses another port. No snapshots or assertions were changed. React Doctor also reports existing example suggestions and a React-18 ref-cleanup warning; the latter was checked against actual React 18 legacy-ref and React 19 cleanup behavior. No rules were suppressed.

Scope

• android/src/main/java/fr/greweb/reactnativeviewshot/ViewShot.java

Unrelated audit changes are submitted separately.