geotiff: apply nodata mask against post-MinIsWhite sentinel (#1809) (#1817)

* geotiff: apply nodata mask against post-MinIsWhite sentinel (#1809)

MinIsWhite inversion was running before the sentinel-to-NaN nodata
mask on all four read backends. Because the inversion rewrites the
sentinel value (uint8 nodata=0 -> 255, float32 nodata=-9999 -> 9999),
the post-inversion equality check matched the wrong pixels:

* stored values that equalled the sentinel survived as iinfo.max -
  sentinel instead of NaN
* stored values that happened to equal iinfo.max - sentinel were
  incorrectly turned into NaN

Introduces _miniswhite_inverted_nodata() in _reader.py and stashes the
inverted sentinel on geo_info._mask_nodata. Every backend (eager numpy,
eager GPU, GPU stripped fallback, dask chunk closure) routes its mask
through the new field while attrs['nodata'] keeps the original sentinel
for write-side round-trip. The dask graph builder picks up the IFD
photometric off geo_info via _read_geo_info / _parse_cog_http_meta so
the closure nodata is inverted at graph-build time.

9 regression tests in test_miniswhite_nodata_1809.py cover uint8 with
nodata=0, uint16 with nodata=65535, float32 with nodata=-9999 across
numpy, dask, and GPU backends, plus no-collision and no-nodata controls.

Closes #1809

* geotiff: address Copilot review comments on #1817

Remove unused os/tempfile imports from the MinIsWhite regression test
and route the GPU tiled read's CPU-fallback branches through
GeoInfo._mask_nodata so a sparse-tile, planar=2 auto-fallback, or
final-fallback decode of a MinIsWhite raster masks against the
post-inversion sentinel rather than the original.

* geotiff: per-tile dim check uses default cap, not caller budget (#1823)

PR #1803 forwarded the caller's max_pixels to read_to_array inside
read_vrt's source loop so a tiny VRT output cannot force a huge source
decode (#1796). The output-window check at the source read enforces that
correctly. A separate per-tile dimension check at the same call sites
also consumed the caller's max_pixels, so a caller setting max_pixels as
an output budget (e.g. 10_000) failed the per-tile sanity check on any
normal source whose default tile size is 256x256 (= 65_536 pixels).

Use MAX_PIXELS_DEFAULT for the per-tile dim check at the two call sites
in _read_tiles (local) and _read_tiles_cog_http (HTTP). The output-window
check at the same functions continues to enforce the user-supplied
max_pixels, preserving the #1796 protection.

Author: brendancol