Address code review: harden the vendored cursor plugin

- Validate scale/devicePixelRatio at the public image() API, in
  registerCursor(), and defensively in the Swift handler (Greptile P1).
- exactAsset() forwards the package argument; asset loads use the
  caller-supplied bundle (creation) and the resolved key's bundle (DPR
  updates) instead of always rootBundle.
- Await platform delete/register in the DPR-update and cache-switch
  paths so registrations cannot interleave; registerCursor() throws a
  descriptive StateError when the native side returns null.
- Drop the Linux platform from the vendored copy: Icarus ships Windows
  and macOS only, and the upstream Linux implementation had unvalidated
  channel arguments, pixbuf leaks, and a missing not-implemented branch.
- Raise the vendored SDK bounds, document the patches in the changelog,
  rewrite the README (stale upstream prose had broken links and typos),
  make the creation-type enum public, and remove the upstream test stub.
436d75a009Dara Adedeji committed on 8/6/2026, 6:25:29 AMparent604d70e
10 files changedLine totals unavailable