fix(data-integrity): validate converter runtime options before encoding #303

Buyer-visible converter boundary

The standalone converter exposes EncodeOptions and per-decode { maxBytes?: number } contracts, but the active converter lane still treats those shapes as TypeScript-only. At runtime, non-number maxBytes values are silently ignored by assertSize(), invalid numeric bounds such as negative/fractional/non-finite values do not have one configuration contract, and a non-string mimeType can reach data-URI interpolation/coercion. JavaScript, untyped, or deserialized hosts can therefore get silently unenforced resource limits or coerced MIME metadata instead of a deterministic Inkspan-owned boundary.

This is local deterministic input validation. It does not add network, persistence, authorization, tenancy, credentials, model/provider, deployment, migration, retention, or durable-audit authority.

Test-first acceptance

1. Continue only on Draft PR fix(reliability): preflight converter payload allocations #160, the sole active writer for src/converter/base64.ts; do not create a competing converter branch. Freeze if that branch/path moves independently.
2. RED on one exact test-only head: prove bytesToDataUri() accepts/coerces malformed mimeType, prove encode/decode APIs silently ignore or mishandle malformed maxBytes, and prove accessor-backed/unknown option properties can execute caller code or escape the finite documented contract.
3. GREEN with one descriptor-safe runtime option resolver: accept only ordinary/null-prototype option bags with documented enumerable data properties, reject accessors/symbols/unknown keys/exotic containers without executing caller code, require mimeType to be a string when present, and require maxBytes to be a non-negative safe integer within an explicit hard ceiling when present.
4. Preserve omitted options, maxBytes: 0, valid MIME strings, Blob/File pre-read bounds, canonical base64/percent preflights, MIME sniffing, accepted data-URI bytes, browser/Node behavior, and existing error precedence for malformed payload data.
5. Fail malformed option shape/value through stable payload-redacted Inkspan configuration errors; do not stringify, trim, normalize, infer, or reflect rejected values.
6. Maintain exact 100% owned-production statement/branch/function/line coverage plus package/browser/Office/security gates and reacquire exact-head evidence after every source movement.

Integration boundary

Keep #160 Draft/unmerged while #118 owns the exact protected 0.6.0 release candidate. Any #160 head or live-base movement invalidates predecessor evidence.