Compressor: throw on overflow instead of returning a negative size

Compress() and FrameTransformation::CompressImage() returned int64_t with a
negative value meaning "did not fit". That is a footgun: the negative result
silently converts to a huge size_t if a caller forgets to check it. Return
size_t and instead throw a named CompressionBufferTooSmallException (deriving
from JFJochException, Compression category) when the output would not fit the
destination buffer.

The receiver catches it explicitly and drops just that frame, as before; the
offline/GetCompressedImage path uses a worst-case buffer so it never throws.
Add a test that a too-small destination throws and a worst-case buffer does not.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/ZSTDCompressorTest.cpp

@@ -249,6 +249,24 @@ TEST_CASE("JFJochCompressor_JFJochDecompressor_ZSTD","[ZSTD]") {
     REQUIRE(memcmp(image.data(), output.data(), x.GetPixelsNum() * sizeof(int32_t)) == 0);
 }
 
+TEST_CASE("JFJochCompressor_DestTooSmall_Throws","[ZSTD]") {
+    DiffractionExperiment x(DetJF4M());
+    x.Compression(CompressionAlgorithm::BSHUF_ZSTD).BitDepthImage(32).PixelSigned(true);
+
+    std::vector<int32_t> image(x.GetPixelsNum(), 345);
+
+    JFJochBitShuffleCompressor compressor(x.GetCompressionAlgorithm());
+
+    // A destination far too small for the compressed output must throw, not overflow it.
+    std::vector<char> tiny(64);
+    REQUIRE_THROWS_AS(compressor.Compress(tiny.data(), tiny.size(), image),
+                      CompressionBufferTooSmallException);
+
+    // A buffer sized to the worst case never throws.
+    std::vector<char> big(MaxCompressedSize(x.GetCompressionAlgorithm(), x.GetPixelsNum(), sizeof(int32_t)));
+    REQUIRE_NOTHROW(compressor.Compress(big.data(), big.size(), image));
+}
+
 TEST_CASE("JFJochCompressor_JFJochDecompressor_LZ4","[ZSTD]") {
     DiffractionExperiment x(DetJF4M());
     x.Compression(CompressionAlgorithm::BSHUF_LZ4).BitDepthImage(32).PixelSigned(true);