Fix open_geotiff eager out-of-bounds window error (#1634)

`open_geotiff(path, window=...)` on the eager (numpy) path produced an
opaque `CoordinateValidationError` when the window extended past the
source extent. `read_to_array` clamped the bad window to file bounds
and returned a smaller array, but the eager code in `open_geotiff`
used the unclamped window indices for y/x coord generation and the
windowed transform shift in `_populate_attrs_from_geo_info`, so the
coord array length differed from the data and xarray refused to
construct the DataArray.

The dask path (`read_geotiff_dask`) already validated the window up
front since #1561, raising a clear `ValueError` with the format
`window=... is outside the source extent (HxW) or has non-positive
size.` The two backends therefore disagreed on the contract.

Fix: validate `window` up front in `open_geotiff`'s eager branch via
`_read_geo_info` (metadata-only read, O(1) memory, no extra pixel
cost) using the exact same condition the dask path applies, raising
the same `ValueError` message format. Out-of-bounds windows now fail
with one consistent error regardless of which backend the user
requests.

12 regression tests in `test_window_out_of_bounds_1634.py` cover:
negative-start, past-right-edge, past-bottom-edge, past-both-edges,
zero-size, inverted-window, full-extent in-bounds, interior subset,
edge-aligned, cross-backend parity (eager == dask), message-format
parity, and the issue's exact reproducer. All 1286 existing
non-network geotiff tests still pass.

Author: brendancol