NewRLE/JPEG decoder: top-row tile copy fails (red square)

[marcos-mendez]

With HMM_KVM_USE_NEWRLE=1 (or codec pill toggled), the chassis honours
fpeg_alg=true and switches to NewRLE/JPEG, but our decoder produces a single
red tile then errors on every subsequent block.

Symptoms (logged):

• Block 0 decodes as solid YCbCr → rendered red
• Block 1 hits copy block source out of range: src=-9 (zip_type=5 wants
  blocknum - blockXcount, no upper neighbour)
• OR block 1 hits type 2 palette too short (7 < 9) then rZipType 7 with no upper neighbour

Hypotheses:

1. Token bit layout off-by-one — chassis may pack zip_type / rZipType
   differently than re/decompiled/.../ImageDecoder.java:317-318 shows.
2. Chunk reassembly leading byte may need handling specific to NewRLE.
3. _decode_rle_type1 bitstream interpreter (6-bit run + 1-bit flip) may
   advance one bit short.

Next step: capture a NewRLE pcap from Palemoon doing the same blade1
session, diff byte-by-byte against our trace.

Workaround: leave codec toggle on OldRLE (default) — known-good.
Tracked separately in #19 (capture).