Validate data slice length before Metal texture upload

Prevents potential out-of-bounds read by checking that the data slice
is at least bytes_per_row * height before passing it to Metal's
replaceRegion:withBytes:bytesPerRow: API.

Co-Authored-By: Claude Opus 4.6 (1M context) <[e-mail]>

crates/platform/src/metal.rs

···
             return None;
         }
 
+        let required = bytes_per_row as usize * height as usize;
+        if data.len() < required {
+            return None;
+        }
+
         let cls = class!("MTLTextureDescriptor")?;
         let desc: *mut c_void = msg_send![
             cls.as_ptr(),