Harden recording renderer CLI bounds

tests/cmake/expect_pano_cli_record_render_failure.cmake

@@ -0,0 +1,24 @@
+if(NOT DEFINED PANO_CLI)
+    message(FATAL_ERROR "PANO_CLI must be set")
+endif()
+
+if(NOT DEFINED EXPECTED_OUTPUT)
+    message(FATAL_ERROR "EXPECTED_OUTPUT must be set")
+endif()
+
+execute_process(
+    COMMAND "${PANO_CLI}" record-render --width 32768 --height 32768
+    RESULT_VARIABLE result
+    OUTPUT_VARIABLE output
+    ERROR_VARIABLE error)
+
+if(result EQUAL 0)
+    message(FATAL_ERROR "Expected pano_cli record-render to fail, but it exited 0")
+endif()
+
+set(combined_output "${output}${error}")
+string(FIND "${combined_output}" "${EXPECTED_OUTPUT}" expected_index)
+if(expected_index LESS 0)
+    message(FATAL_ERROR
+        "Expected output to contain '${EXPECTED_OUTPUT}', got: ${combined_output}")
+endif()