On Windows with Defender at its defaults, opening the freshly written
optional-header-incomplete-import-entry image stalled for up to about
10 s and timed the test out. MoveImportFirst throws before it writes to
the image, and MoveImportFirstInFile writes the file only after
MoveImportFirst returns, so the malformed-image cases need no file
round trip. Check them on a copy of the bytes and keep the
missing-import case on disk for the unchanged-file path.
Read the Import Directory entry only when the optional header holds it and NumberOfRvaAndSizes declares it. Require every import name to end with a NUL inside the file and resolve the names after the descriptor table is bounds-checked.