Use designated initializers for DecodedImage so a field reorder cannot
silently swap the image and its error string.
Extract the cancelled-request sweep shared by the dispatcher and the
single-request path into takeCancelledRequests(), and cover it: one status
retirement per vanished work item, in queue order, with live entries kept.
