feat: ship image prompts and verified transcript images

[lyc-aon]

What changed

• sends up to eight PNG, JPEG, WebP, or GIF prompt images through bounded 256 KiB uploads
• renders transcript images only after bounded readback, MIME validation, and SHA-256 verification
• keeps staged drafts recoverable across rejected, interrupted, and outcome-unknown sends
• adds reduced-motion animation controls and bounded transcript image concurrency/cache use
• times out stalled desktop/browser sockets and retries old hosts once without either image feature
• preserves Android WebView 60 image reads through a FileReader fallback
• vendors verified app-wire 0.5.5 and pins the public OMP 16.5.1 appserver-4 runtime
• cuts the coordinated T4 Code v0.1.12 site, desktop, and Android release contract

Runtime

The verified public runtime is lyc-aon/oh-my-pi commit 6a87fa6407ebff20417b4d52885a6bb3091003ea, tag t4code-16.5.1-appserver-4. Its app-wire subtree is a2495fe8781c979184fe7fb9a6d37d8f33bad30f and the vendored package SHA-256 is 049d92d47c0c29a019c3844072b96198105116c452a54182163ef78994ef557e. The upstream work remains split across can1357/oh-my-pi#5410, #5413, #5472, #5488, and #5530.

Validation

• pnpm check
• 37 tooling tests
• 917 workspace tests across all ten packages and apps
• 16 Playwright browser/mobile E2E tests
• 18 packaging contract tests
• Linux deb and AppImage build plus ASAR/protocol inspection
• Android debug APK build, v2 signature verification, package/version/SDK inspection
• two independent P1/P2 audits of the final OMP app-wire fixes and T4 release repin