FormatSet cannot represent ImageFormat::Custom — all() excludes PDF/DNG/RAW, allowlists deny every Custom format

Structural, currently latent. Only zencodec can fix it — it owns ImageFormat::Custom and ImageFormatRegistry (src/format/mod.rs:336).

The bug

zenpipe/zencodecs/src/format_set.rs:18-33 — FormatSet::bit() returns None for ImageFormat::Custom(_). Consequences:

• FormatSet::contains(Custom) is always false
• FormatSet::all() (:50) excludes every Custom format (PDF, DNG, RAW)
• CodecPolicy::is_format_allowed(Custom) (zencodecs/src/policy.rs:193-198) therefore denies every Custom format whenever an explicit allowlist is set

zencodecs works around it with a parallel custom_decode: u16 side-channel in AllowedFormats (registry.rs:249-256, name-keyed via custom_decode_bit at :105) — decode-side only.

Why latent, not live

is_format_allowed is called only from select.rs and available_encode_formats (encode-side selection), and Custom formats are decode-only today. It becomes live the moment a Custom format is encodable.

Why it belongs here

A u16 bitflag structurally cannot represent ImageFormat::Custom(&static ImageFormatDefinition). Fixing it requires the registry/identity model that lives in zencodec, not a bitflag in a downstream crate. zencodec has no FormatSet equivalent today — this is part of the broader "upstream the codec-agnostic policy" question (separate issue).