A signed mask with a negative label makes the background an object #35

Data-flow audit 2026-10-29 (H1), BLOCKER. At v0.3.1 (c179357).

What happens:

• masks.py:391 accepts any integer mask, signed included.
• mask_scan.py:251-256 drops 0 only when it is the smallest value (values[0] == 0).
• With a negative label present, 0 is not first, so it is kept as a label, and every non-zero value (negatives included) is an object (:274).

Failure: an int16 mask with -1, 0 and 3 gives the labels [-1, 0, 3]. The background becomes an object, and object counts, the mask kind and mask_relationships.json come out wrong with no warning. Contract §15.1 says only "label 0 is background".

Fix: refuse negative labels when the mask header and pixels are checked (as MorphoFeature and the providers do), or always remove 0 explicitly. Add a regression test with a signed mask.