[Audit/Scientific integrity] Missing axes metadata in NGFF 0.4/0.5 can silently default 5D images to TCZYX #73

Scope

Sad Catapella adversarial audit, Batch 2, main at d7a538e. Confirmed source-level fallback; runtime fixture not executed.

Evidence

• ngff_axes(), lines 347–357 converts absent/empty axes metadata into TCZYX whenever ndim == 5.
• _level0(), lines 284–322 calls ngff_axes(first.get('axes'), len(array.shape)) without any version check; the metadata version is read only after this default has been applied.
• inspect_ome_zarr() records the guessed TCZYX as readable declared axes. The subsequent axis review can accept them directly, and the axis check skips OME-Zarr.
• Tests cover the legacy ngff_axes(None,5) behavior for 0.1/0.2, but not an NGFF 0.4/0.5 store whose required axes field was removed.

Reproduction fixture to add

Create an OME-NGFF 0.4 or 0.5 5D store whose multiscales metadata contains a dataset, version and level-0 array but no axes entry; store its array in a deliberately non-TCZYX order. Current code describes it as TCZYX and can run without axes_not_named warning. It must instead reject malformed modern NGFF metadata. A valid legacy 0.1/0.2 5D fixed-order fixture should retain historical handling if those versions remain supported.

Impact

Undeclared axis identities can be incorrectly inferred as time/channel/depth, with silent scientific data corruption.

Fix

Validate the axes requirement by actual NGFF version in _level0, before calling the translator. For 0.4/0.5, refuse missing/empty axes with NgffError (unreadable_ome_zarr in preflight) and an actionable message. Preserve only explicitly documented legacy behavior for 0.1/0.2; if the version is unknown, do not infer modern roles. Add both versioned fixtures to tests/test_zarr_input.py. No Numba opportunity.