Preserve image HTML attributes and enforce loading contracts

[kvz]

Why

Ordinary image attributes disappeared between the Server Component snapshot and the picture renderer. In particular, accepted JSX accessibility attributes could silently lose their description relationship. Invalid loading combinations also compiled, and lazy automatic sizing never activated on the image.

Changes

• Derive serializable native image props from React's types and filter them at runtime. Preserve IDs, descriptions, titles, roles and data attributes across both direct and redirect rendering; keep caller URLs, callbacks and signing/model configuration out of native markup.
• Make preload/loading a discriminated union and expose redirect-specific props without a Suspense fallback. Retain JavaScript runtime guards.
• Emit explicit 100vw for omitted width-descriptor source sizes. Put sizes="auto" on lazy images requesting automatic sizing, leave fallback lengths on sources, and reject eager automatic sizing.
• Match the image's cross-origin/referrer policy in its responsive preload.

Verification

• Added regressions first: 12 runtime failures and previously accepted invalid type fixtures reproduced against main; logs retained locally.
• yarn workspace @transloadit/img check (73 tests plus type fixtures).
• yarn test:img:fixture: packed-package production Next build, safe prerendering, request-time signing, authorized redirects, tampering and secret exclusion.
• Focused Biome and git diff --check.

This is PR A of the agreed four-PR iteration. No signing policy/default lifetime changes, publication or production access. Layout placeholders, lifecycle documentation and Storage onboarding follow separately. The orchestrator will run council review after the round. The fixture does not yet prove native browser loading or visual/layout performance; that bounded proof is a later, separately scoped step.

[kvz]

Superseded by #500, which now carries the whole change against main.