Image.ConstructorOptions.maxPixels

Reject inputs whose width × height exceeds this many pixels. The check runs after the header is read but before any pixel buffer is allocated, so a tiny file claiming a huge canvas is refused cheaply.