guard uninitialized count from descr sscanf in npy parser

[soma0212]

load_npy walks a raw cursor through the header dict, and one sscanf can leave that cursor undefined:

• the 'descr' scan reads %c%c%d then a literal closing quote, and only the trailing %n writes the byte count, but %n is not part of sscanf's return value
• a descr missing its closing quote still returns 3, so consumed stays uninitialized and ptr += consumed jumps by a garbage offset that the next read dereferences
• initializing consumed and requiring it to be set rejects the malformed dict instead of advancing the cursor into unmapped memory

Reachable from any .npy opened through load_image; an ASAN build faults inside NpyHeader::parse on a header whose descr drops the quote. Added a regression test that writes such a file and checks the loader returns false.

Checklist

• Tests added or updated (not required for docs, CI config, or typo fixes)
• Documentation updated (if public API changed)
• Python bindings updated (if public API changed)
• Benchmarks are included here if the change is intended to affect performance.
• Commits include AI attribution where applicable (see Code of Conduct)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
⚠️ Please upload report for BASE (main@34f0771). Learn more about missing BASE report.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #9222   +/-   ##
=======================================
  Coverage        ?   69.79%           
=======================================
  Files           ?      255           
  Lines           ?    78885           
  Branches        ?    18859           
=======================================
  Hits            ?    55054           
  Misses          ?    18275           
  Partials        ?     5556           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.