feat(metadata)!: migrate metadata stack to gamut-exif/gamut-icc/gamut-xmp

[justin13888]

Closes #19.

Stacked on #42 (base branch 18-core-gamut-reexports) — merge #42 first; GitHub will retarget this to master automatically.

What is Delivered

• Decode-side EXIF on gamut-exif. ExifParser parses blobs via gamut_exif::Exif, mapping tag-for-tag to the same ImageMetadata fields as before (camera, exposure, datetime, GPS incl. timestamp/speed/direction via direct gps_ifd reads, orientation). The extra-table mirror is rebuilt by iterating every IFD's fields with typed Value conversion — no more manual byte decoding. little_exif walked containers itself, so blob-location scanners (JPEG APP1 / PNG eXIf / WebP EXIF / AVIF Exif item / TIFF) are added as a documented transitional layer until each codec migration hands over codec-side MetadataBlock extraction.
• Encode-side EXIF builds a gamut_exif::Exif (ISO now widens to LONG instead of truncating past u16); bare-TIFF bytes via ExifWriter. JPEG append stays on img-parts per the epic carve-out (final removal rides with Migrate JPEG to gamut #31).
• ICC internals on gamut-icc. IccProfile keeps its public API; srgb() is now constructed from typed parts (identical s15Fixed16 colorant constants, D50 PCS, gamma curve) and serialized via to_bytes(); is_valid() delegates to gamut's parser. Bonus fix: the old hand-rolled desc element was malformed textDescriptionType — the gamut-built profile is spec-valid, pinned by a test that parses back colorants and TRC.
• XMP validation via gamut-xmp: append fns now reject malformed packets (XmpError::Invalid) instead of embedding garbage.
• The bridge: metadata/bridge.rs with to_gamut/from_gamut between ImageMetadata and gamut_metadata::Metadata; module docs enumerate exactly what does not survive to_gamut (DNG structs, sensor fields, extra, makernote/iptc blobs). Round-trip tested.
• little_exif dropped (lockfile also sheds brotli/crc). One robustness win pinned in a test: a truncated EXIF stream now returns a structured error where little_exif panicked.

Deviations from the issue text, with reasons

1. The AVIF/JXL EXIF appends could not "stay as-is" — they were little_exif calls. Replaced with rawshift-side box splicing in the pre-existing ICC/XMP style: new metadata/isobmff.rs owns ISOBMFF item insertion/extraction (infe + iloc + cdsc iref + mdat with extent-offset patching), shared by the EXIF and ICC paths. This honors the full little_exif drop without a dual path. Verified end-to-end by the existing avif_exif_round_trip test against real encoder output.
2. The issue's "JPEG embedding blocked on gamut#28" carve-out is kept as a boundary (img-parts removal rides with Migrate JPEG to gamut #31) even though gamut#28 has since closed — moving JPEG APP-segment muxing is Migrate JPEG to gamut #31's scope, not this PR's.

Gap audit (issue requirement)

No blocking gamut gaps found. Non-blocking notes: gamut-exif's typed GpsInfo is both-or-nothing on coordinate+hemisphere and can't distinguish an absent GPSAltitudeRef from the 0 default — cosmetic, generic IFD access covers it. Typed camera/DNG structs remain gamut#258. MakerNote passthrough is covered upstream (opaque bytes + original-offset pinning by the writer).

Verification Done

Run independently after the implementation (not just the implementer's own runs):

• cargo test --workspace — 383 passed, 0 failed
• cargo test -p rawshift-image --features full — 566 passed, 0 failed (includes avif_exif_round_trip, the new ICC parse-back pin, XMP rejection tests, bridge round-trips)
• cargo test -p rawshift-image --features serde — 365 passed, 0 failed
• cargo clippy --workspace --all-targets -- -D warnings and cargo clippy -p rawshift-image --all-targets --features full -- -D warnings — both clean
• cargo fmt --all -- --check — clean; lefthook pre-commit green
• grep little_exif across manifests + lockfile — gone (one historical mention in a test comment documenting the panic little_exif had)