test[ocr-ggml]: bounded FuzzTest for image decode and size overflow guards

[jpgaribotti]

🎯 What problem does this PR solve?

• decodeOrWrapImage is the OCR addon's untrusted-input front door: encoded JPEG/PNG bytes, or a raw bitmap with attacker-controlled width / height / bpp.
• Encoded length was cast to int for cv::Mat, and raw width * height * bpp could wrap size_t — the same overflow class as the NMT n_dims crash in Fix NMT ndims overflow crash #4590.
• OCR had no C++ fuzz CI.

📝 How does it solve it?

• Extract decodeOrWrapImage into DecodeImage.cpp so it can be fuzzed without @qvac/fabric.
• Reject encoded buffers whose length would truncate when cast to int, and raw bitmaps whose width × height × bpp overflows size_t.
• Add ocr-decode-image-fuzz (OpenCV only, full ASan + LSan) with a generated PNG seed and raw size-mismatch seeds.
• Add Linux-only cpp-tests-ocr.yml and wire it from on-pr-ocr-ggml.yml.
• Patch bump @qvac/ocr-ggml 0.24.3 → 0.24.4. No public addon API changes.

🧪 How was it tested?

• Follows the classification-ggml Phase 0 template (docs/architecture/ADDON-FUZZING.md).
• Bounded mode is what Linux C++ CI will run (npm run fuzz:build + npm run fuzz:run).
• on-pr-ocr-ggml.yml is pull_request_target and reads workflow YAML from main, so the new fuzz job runs after this lands, not on this PR itself.

[github-actions]

Review Status

Current Status: ❌ PENDING
Approvals so far: none

Pending reviews: Needs 1 Management or Team Lead, and 1 more from Management, Team Lead, or Member.