showimage: loader, detect, viewer widget, EXIF orientation, tests (gt0)

M1 (task gt0): show one image with zoom/pan.

- src/loader/detect.{c,h}: magic-byte format sniffing (JPEG/PNG/GIF/WebP/
  TIFF/ICO/JXL/AVIF/HEIF) -> GgazeFormat; pure, no I/O, unit-testable.
- src/loader/loader.{c,h}: loader_load() sniffs the header and dispatches to
  the first registered backend; GgazeLoaderBackend struct; pixbuf is the
  fallback (last, accepts UNKNOWN). M1 ships only the pixbuf backend.
- src/loader/backends/pixbuf.c: GdkPixbufLoader decode +
  gdk_pixbuf_apply_embedded_orientation (decision #26) -> GdkTexture via
  gdk_memory_texture_new (avoids the deprecated gdk_texture_new_for_pixbuf).
- src/viewer.{c,h}: GgazeViewer : GtkWidget custom widget (decision #31) —
  fit/100%/in/out zoom, cursor-centered zoom, drag-to-pan with clamping,
  dark background, GtkSnapshot render nodes.
- src/window.c: open -> loader_load -> viewer_set_texture -> stack 'large'.
- tests: unit test_detect (13 cases) + test_loader_pixbuf (plain/rotated-EXIF
  8x4 orient6->4x8/png/rgba/missing/unsupported jxl-avif-heif/corrupt),
  integration test_open_and_show (fixture + rotated + ./sample-images
  skip-if-absent). 6/6 green; detect 97% / loader 91% / pixbuf 87% coverage.
- fixtures: gen.py produces plain.jpg, rot6.jpg, small.png, rgba.png.
- AGENTS.md: documents the ./sample-images optional test corpus convention.

Sub-agent review fixes: use-after-free of c_name in ggaze_window_open
(BLOCKER), gtk_stack_get_pages leak in test_window (BLOCKER), coverage gap,
dead branch, viewer measure, _prefix/_cb naming, include order, extern in
header, pan clamp, stale comments — all addressed.

1 files changed, 45 insertions, 0 deletions

diff --git a/src/loader/loader.h b/src/loader/loader.h
new file mode 100644
index 0000000..0795097
--- /dev/null
+++ b/src/loader/loader.h
@@ -0,0 +1,45 @@
+#ifndef GGAZE_LOADER_H
+#define GGAZE_LOADER_H
+
+/*:*
+ * ggaze — image loader
+ *
+ * Synchronous load API for M1; M3 adds loader_load_async/_finish on top of the
+ * same worker. The loader sniffs the format from the file header (detect.c)
+ * and dispatches to the first registered backend whose can_load() accepts the
+ * header. GdkPixbuf is the fallback backend (covers PNG/JPEG/GIF/WebP/TIFF/ICO
+ * and anything GdkPixbuf happens to understand); JXL/AVIF/HEIF get specific
+ * backends in M5. Every backend honors EXIF Orientation so the returned
+ * GdkTexture is upright (decision #26). See docs/architecture.md "Image
+ * decode".
+ *
+ * Copyright (c) 2026 ggaze contributors
+ * SPDX-License-Identifier: GPL-3.0-or-later
+ *:*/
+
+#include <gdk/gdk.h>
+#include <gio/gio.h>
+#include <glib.h>
+
+G_BEGIN_DECLS
+
+/* A loader backend. Compiled in conditionally (meson feature options) and
+ * registered with the loader at link time. */
+typedef struct {
+   gboolean (*can_load)(const guint8 *p_head, gsize u_len);
+   GdkTexture *(*load)(GFile *p_file, GCancellable *p_cancel,
+      GError **p_err);
+} GgazeLoaderBackend;
+
+/* Backends register a const instance; the dispatcher (loader.c) iterates
+ * BACKENDS[] in priority order. pixbuf_backend is the fallback and MUST stay
+ * last (it accepts GGAZE_FMT_UNKNOWN). */
+extern const GgazeLoaderBackend pixbuf_backend;
+
+/* Synchronously load p_file into a GdkTexture (EXIF orientation applied).
+ * Returns a new GdkTexture (caller owns it) or NULL with p_err set. */
+GdkTexture *loader_load(GFile *p_file, GCancellable *p_cancel, GError **p_err);
+
+G_END_DECLS
+
+#endif /* GGAZE_LOADER_H */
\ No newline at end of file