Detect invalid manifest images during analysis; improve MIME error recovery in Google Play packaging

[Copilot]

When a PWA's manifest references missing images (e.g., a Render.com SPA serving index.html for missing .png paths), analysis was passing IconsAreFetchable as valid, allowing Google Play packaging to proceed and fail with Bubblewrap's cryptic "Could not find MIME for Buffer" error.

Analysis fix — ImageValidationService.cs

New content-type check in TryDecodeImageAsync: After fetching the image body via GET, the response Content-Type is now validated before attempting Image.IdentifyAsync. This catches the SPA soft-404 pattern where a HEAD request returns Content-Type: image/png (MIME-sniffed from the URL extension) but the GET body returns Content-Type: text/html:

var responseContentType = response.Content.Headers.ContentType?.MediaType;
if (!string.IsNullOrEmpty(responseContentType)
    && !responseContentType.StartsWith("image/", StringComparison.OrdinalIgnoreCase)
    && responseContentType != "application/octet-stream")
{
    return ImageDecodeResult.Undecodable; // HTML served for a .png → invalid
}

application/octet-stream is excluded since some servers use it for valid binary downloads.

CancellationToken threading: TryDecodeImageAsync, ValidateFetchedImageAsync, and TryImageExistsAsync now pass the cancellation token through all HTTP requests and stream reads. Previously the decode-validation GET had no cancellation, so it wouldn't respect the 180-second analysis job timeout.

Packaging recovery fix — packageCreator.ts

Added "Could not find MIME for Buffer" to the set of errors that trigger a retry via the PWABuilder image proxy. The proxy (getSafeImageForAnalysis) validates image bytes server-side and returns a clear 400 for missing/corrupt images, replacing the opaque Bubblewrap error with actionable feedback.

const isInvalidImageMime = errorMessage.includes('Could not find MIME for Buffer');
if (is403Error || isTimeout || isRunDotAppManifestError || isWrongContentType || isInvalidImageMime) {
    // retry with proxied URLs...
}

[microsoft-github-policy-service]

Thanks @Copilot for opening a Pull Request! The reviewers will test the PR and highlight if there is any conflict or changes required. If the PR is approved we will proceed to merge the pull request 🙌