NR.5 Example, good | check_size adjustment

Quick Link to NR.5

In the good example, we have the following contract check:

static size_t check_size(size_t s)
{
    // invariant check
    Expects(s > 0);
    return s;
}

The problem with this function is, that check_size(-1) does not throw as you’d expect only reading the contract.

I propose to implement exactly one of the two ideas below to fix this:
Idea 1: Change the check to Expects(s != 0);, as s cannot be negative, and thus be more expressive in what exactly is checked.
Idea 2: Change the type of s to a signed integer one, maybe ptrdiff_t or intmax_t, and cast s to size_t after the check. (Alternatively, change to type of Picture::mx and Picture::my altogether.)

The latter approach has the advantage that calling Picture picture(100, -1); does not try to allocate excessive amounts of memory. On the other hand, the constructor would have to change, too, and a compiler should warn about the signed/unsigned mismatch anyway …