showimage: loader, detect, viewer widget, EXIF orientation, tests (gt0)

M1 (task gt0): show one image with zoom/pan.

- src/loader/detect.{c,h}: magic-byte format sniffing (JPEG/PNG/GIF/WebP/
  TIFF/ICO/JXL/AVIF/HEIF) -> GgazeFormat; pure, no I/O, unit-testable.
- src/loader/loader.{c,h}: loader_load() sniffs the header and dispatches to
  the first registered backend; GgazeLoaderBackend struct; pixbuf is the
  fallback (last, accepts UNKNOWN). M1 ships only the pixbuf backend.
- src/loader/backends/pixbuf.c: GdkPixbufLoader decode +
  gdk_pixbuf_apply_embedded_orientation (decision #26) -> GdkTexture via
  gdk_memory_texture_new (avoids the deprecated gdk_texture_new_for_pixbuf).
- src/viewer.{c,h}: GgazeViewer : GtkWidget custom widget (decision #31) —
  fit/100%/in/out zoom, cursor-centered zoom, drag-to-pan with clamping,
  dark background, GtkSnapshot render nodes.
- src/window.c: open -> loader_load -> viewer_set_texture -> stack 'large'.
- tests: unit test_detect (13 cases) + test_loader_pixbuf (plain/rotated-EXIF
  8x4 orient6->4x8/png/rgba/missing/unsupported jxl-avif-heif/corrupt),
  integration test_open_and_show (fixture + rotated + ./sample-images
  skip-if-absent). 6/6 green; detect 97% / loader 91% / pixbuf 87% coverage.
- fixtures: gen.py produces plain.jpg, rot6.jpg, small.png, rgba.png.
- AGENTS.md: documents the ./sample-images optional test corpus convention.

Sub-agent review fixes: use-after-free of c_name in ggaze_window_open
(BLOCKER), gtk_stack_get_pages leak in test_window (BLOCKER), coverage gap,
dead branch, viewer measure, _prefix/_cb naming, include order, extern in
header, pan clamp, stale comments — all addressed.

1 files changed, 67 insertions, 0 deletions

diff --git a/src/loader/loader.c b/src/loader/loader.c
new file mode 100644
index 0000000..b1c4851
--- /dev/null
+++ b/src/loader/loader.c
@@ -0,0 +1,67 @@
+/*:*
+ * ggaze — image loader dispatcher
+ *
+ * Reads a short header, sniffs the format, and hands off to the first backend
+ * whose can_load() accepts it. BACKENDS[] is ordered so format-specific
+ * backends (JXL/AVIF/HEIF, M5) win over the GdkPixbuf fallback, which is last
+ * and accepts GGAZE_FMT_UNKNOWN. M1 ships only the pixbuf backend.
+ *
+ * Copyright (c) 2026 ggaze contributors
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *:*/
+
+#include "loader.h"
+
+#include <gio/gio.h>
+#include <glib.h>
+
+#include "detect.h"
+
+/* Registered backends, priority order (specific first, fallback LAST).
+ * pixbuf_backend must remain last: it accepts GGAZE_FMT_UNKNOWN. */
+static const GgazeLoaderBackend *BACKENDS[] = {
+   /* jxl_backend, avif_backend, heif_backend land here in M5. */
+   &pixbuf_backend,
+};
+
+#define GGAZE_SNIFF_LEN 64
+
+static gsize
+_read_header(GFile *p_file, GCancellable *p_cancel, guint8 *p_head, gsize u_max,
+             GError **p_err) {
+   GError           *p_sub = NULL;
+   GFileInputStream *p_in  = g_file_read(p_file, p_cancel, &p_sub);
+   if (p_in == NULL) {
+      g_propagate_error(p_err, p_sub);
+      return (0);
+   }
+   gssize n = g_input_stream_read(G_INPUT_STREAM(p_in), p_head, u_max, p_cancel,
+                                  &p_sub);
+   g_object_unref(p_in);
+   if (n < 0) {
+      g_propagate_error(p_err, p_sub);
+      return (0);
+   }
+   return ((gsize)n);
+}
+
+GdkTexture *
+loader_load(GFile *p_file, GCancellable *p_cancel, GError **p_err) {
+   g_return_val_if_fail(G_IS_FILE(p_file), NULL);
+
+   guint8 head[GGAZE_SNIFF_LEN];
+   gsize  u_read = _read_header(p_file, p_cancel, head, GGAZE_SNIFF_LEN, p_err);
+   if (u_read == 0 && p_err != NULL && *p_err != NULL) {
+      return (NULL);
+   }
+
+   for (gsize u_i = 0; u_i < G_N_ELEMENTS(BACKENDS); u_i++) {
+      if (BACKENDS[u_i]->can_load(head, u_read)) {
+         return (BACKENDS[u_i]->load(p_file, p_cancel, p_err));
+      }
+   }
+
+   g_set_error(p_err, G_IO_ERROR, G_IO_ERROR_NOT_SUPPORTED,
+               "unsupported or unrecognized image format");
+   return (NULL);
+}
\ No newline at end of file