docs(libSceJpegDec): state input-control gaps first and condense debt entry

Assisted-by: Antigravity:gemini-3.8-flash

docs/dev/debt/libSceJpegDec.md

@@ -4,4 +4,4 @@
 
 - [libSceJpegDec](../../../core/libs/prx/libSceJpegDec/Export.cpp): work-memory size, alignment, creation checks, image-info fields, progressive coefficient-buffer capacity, row-buffer capacity and scaled dimensions are recovered from the native module. The host still allocates its decoder storage separately rather than using the guest work and coefficient regions. Malformed-header diagnostics and output mutation on failure are not fully matched.
 - [sceJpegDecDecode](../../../core/libs/prx/libSceJpegDec/Export.cpp): decode mode 1 and pixel formats 9, 10 and 11 remain unimplemented and throw. Exact decoded pixel values and color conversion are not verified against the native decoder. One title (PPSA29866) disassembled for this entry has one call site (0x2c111d); it passes a null `imageInfo` and a parameter structure with decode mode 0, down-scale 1 and pixel format 0, and hands the result to another function whose handling of a negative result was not read. In the parameter structure built around this call site, mode 1 and formats 9, 10 and 11 do not show up; whether a down-scale of 1 means no scaling was not compared.
-- [sceJpegDecDecodeWithInputControl](../../../core/libs/prx/libSceJpegDec/Export.cpp) (libSceJpegDec): input is requested from the callback in 2048-byte blocks until the frame header (parse) or the end-of-image marker (decode) is buffered. libSceJpegDec.sprx (firmware 13.60, read from disassembly, not measured on a console) refills its 2 KiB buffer whenever fewer than 0x3F0 bytes are left, so the callback can be called a different number of times. Decode mode 1, pixel formats 9 to 11, an unlisted parse down scale, decoding without a parse and decoding at another down scale than the parse throw. A stream that ends before the frame header, or whose buffered bytes can no longer form one, returns 0x80650012 (measured on PS5 firmware 13.42 libSceJpegDec.sprx; sceJpegDecParseHeader on the same bytes returns 0x80650010 or 0x80650002); how far the console reads differs from this implementation. Streamed bytes are kept in host memory, not in the work memory; a stream whose work memory is freed without `sceJpegDecDelete` stays there.
+- [sceJpegDecDecodeWithInputControl](../../../core/libs/prx/libSceJpegDec/Export.cpp) (libSceJpegDec): decode mode 1, pixel formats 9 to 11, unlisted parse down scale, decoding without parse and decoding at another down scale throw. A stream that ends before the frame header, or cannot form one, returns 0x80650012 (measured on PS5 firmware 13.42 libSceJpegDec.sprx; sceJpegDecParseHeader on the same bytes returns 0x80650010 or 0x80650002); callback call counts differ because the firmware (13.60 disassembly) refills its 2 KiB buffer when under 0x3F0 bytes remain, whereas this implementation pulls in 2048-byte blocks. Streamed bytes reside in host memory; freeing work memory without `sceJpegDecDelete` leaves them allocated.