* fix: address security scanner findings * fix: close image-size parser review gap * test: prove zero-length image box regressions * fix: keep fixture fingerprint output machine-readable * test: align fixture fallback with fingerprint owner