Require explicit opt-in on experimental and internal-only GeoTIFF paths (PR 4 of epic #2340)

[brendancol]

Summary

• Adds the matching read-side gates for the Tier 3 / Tier 4 codecs the writer already gated in geotiff: tier the public surface; mark experimental codecs/features opt-in #2137 and write_geotiff_gpu emits JPEG TIFFs that other readers reject #1845. open_geotiff / read_geotiff_dask / read_geotiff_gpu / read_vrt now reject sources using LERC / JPEG2000 / J2K / LZ4 unless allow_experimental_codecs=True, and reject JPEG-in-TIFF unless allow_internal_only_jpeg=True. The two flags do not collapse, mirroring the writer side.
• Extends allow_experimental_codecs onto the writer rich-tag attrs (gdal_metadata_xml / extra_tags). Round-tripped attrs that carry the _xrspatial_geotiff_contract marker (set by the readers) are exempt so the canonical attrs round-trip from geotiff: define a public contract for DataArray attrs (canonical / alias / pass-through) #1984 keeps working without a flag; fresh DataArrays that set those attrs explicitly require the opt-in.
• Gates fire at the public entry point (eager) or at graph build (dask), before any decode work runs, so the caller learns the opt-in name from the rejection.

Scope notes

PR 4 of 6 under epic #2340. Closes #2352.

Out of scope, covered by sibling PRs:

• Docstring rewrites for the seven public read/write functions (Audit public GeoTIFF docstrings against release contract (epic #2340) #2346)
• GeoTIFF release-contract docs page (Docs: GeoTIFF release-contract page defining tier semantics #2347)
• SUPPORTED_FEATURES tier audit (Align SUPPORTED_FEATURES with epic #2340 tiering #2348)
• Unsupported-combination errors (Fail loudly on unsupported GeoTIFF feature combinations (PR 5 of epic #2340) #2349)

Test plan

• test_experimental_internal_optin_2352.py covers signature pins, validator unit tests (stable / experimental / internal-only / round-trip exemption), end-to-end read rejections + opt-in acceptance for LERC / LZ4 / JPEG2000 / JPEG-in-TIFF, and the dask graph-build gate.
• Existing test_supported_features_tiers_2137.py still passes (writer-side flag pins).
• Existing codec / rich-tag tests updated to thread the new opt-ins through; test_reader_kwarg_order_1935.py canonical order slots the new flags next to the other allow_* gates.
• Full xrspatial/geotiff/tests/ suite passes locally (4517 passed; CPU + dask paths, GPU + network deselected).
• Broader xrspatial/tests/ suite still passes locally (3889 passed).

[brendancol]

Self-review

Suggestions (should fix, not blocking)

• xrspatial/geotiff/_attrs.py:328 -- The _COMPRESSION_TAG_TO_NAME mapping collapses tag 32946 (Adobe Deflate) onto 'deflate', which is correct today: both tags decode through the same codec and 'deflate' sits in the stable tier. Worth a one-line comment that this collapse is deliberate so a future Adobe-Deflate-specific tier entry can't drift through unnoticed.
• xrspatial/geotiff/_attrs.py:438 -- The round-trip exemption checks '_xrspatial_geotiff_contract' in attrs. A caller could in theory forge this marker to bypass the gate. Acceptable trade-off given the alternative would break the geotiff: define a public contract for DataArray attrs (canonical / alias / pass-through) #1984 round-trip contract, but a comment that this is a soft gate by design would help a future reviewer.
• xrspatial/geotiff/_backends/dask.py:323 -- The dask read-side gate uses getattr(geo_info, '_ifd_compression', None). If a synthesised geo_info has no _ifd_compression, the gate is silently skipped. The only callers that hit this branch are non-TIFF sources (which by definition have no TIFF compression tag), but a one-line comment would help a future reviewer verify the skip is intentional.

Nits

• The PR touches 22 existing test files to thread the new opt-ins. Each edit is small and mechanical (add allow_experimental_codecs=True or allow_internal_only_jpeg=True to a read call). A short paragraph in the PR body listing the test categories (codec round-trip, rich-tag round-trip, golden-corpus, canonical kwarg-order) would help future archaeology.

What looks good

• Validator helpers in _attrs.py are well-isolated, pure, and well-documented. Easy to unit-test in test_experimental_internal_optin_2352.py.
• Rejection messages name the missing flag, the feature, the tier, and the parent epic. A caller hitting the gate can fix the call site without grepping source.
• Dask path fires the gate at graph build, before any chunk task runs -- matches the contract the dask max_pixels guard already follows.
• Round-trip exemption preserves the geotiff: define a public contract for DataArray attrs (canonical / alias / pass-through) #1984 canonical attrs contract while still gating fresh DataArrays. Threading via the contract marker is a clean signal.
• GPU read path forwards the flag through every CPU-fallback site (5 call sites in _backends/gpu.py).
• New test file (479 lines) covers signature pins, validator unit tests, end-to-end read rejections, opt-in acceptances, dask graph-build gate, round-trip exemption, JPEG vs experimental flag non-collapse, and the already-gated paths.
• test_reader_kwarg_order_1935.py canonical order updated so the new flags slot next to the existing allow_* policy gates.

Checklist

• Default behaviour rejects experimental + internal-only codec reads
• Default behaviour rejects rich-tag writes on fresh DataArrays
• Read-then-write round-trip stays no-flag (via contract marker)
• All read backends share one validator call shape
• Tests pin every gate, every exemption, every signature
• All four public read entry points expose the new kwargs
• Docstrings on the public surface name both flags