fix(nexus): flatten live image models and correlate failures

[smackgg]

Summary

• mark the bounded live Nexus image-model catalog for direct host projection while leaving the free-text fallback untrusted
• release Nexus Plugin 0.3.8 with companion 0.3.7
• correlate image calls with the host operation id and surface only HTTP status, an allow-listed Gateway error code, and the local request id
• keep image execution on the existing Chat Completions route; this change does not retry or start any provider request

Validation

• bun install --frozen-lockfile --ignore-scripts
• bun run workspaces:build:packages
• Nexus companion build and typecheck
• bun run validate
• bun run workspaces:typecheck
• bun run workspaces:test
• bun run build:companions
• bun test (382 passed)
• bun run pack
• bun run build:index
• git diff --check

Security review

Response-provided request ids are ignored, upstream error codes cross the MCP boundary only through a fixed Gateway allowlist, and raw messages, response bodies, prompts, tokens, and paths remain private.