Render exact image previews and make app icons source-driven

[hamzamerzic]

Problem

Viewed-image activity can carry a private filesystem path that the browser cannot fetch, so successful inspections may end as “Image preview unavailable.” App artwork also had two competing truths: manifests declared an icon, but only Store installs materialized it, while the shell inferred icon availability from a separate boolean and compatibility fallback.

What changed

• Render protected chat media through its existing authenticated URL and render other viewed images from the exact bounded image output returned by the tool. Arbitrary filesystem paths remain private; no /tmp or source-tree serving route is added.
• Share the existing accessible, zoomable image-preview interaction and preserve browser Back dismissal, selection, settled loading, and honest unavailable states.
• Make the icon declared by an accepted app manifest the package-artwork source of truth for both local apply and Store install.
• Normalize icons through one bounded image boundary, reject invalid local revisions atomically, and repair historical local apps from their accepted Git commits rather than mutable drafts.
• Keep owner-selected home-screen artwork as an explicit override, separate from package artwork.
• Expose one versioned icon_url (or null) to the shell instead of a boolean plus reconstructed route; drawer, app links, and install UI consume that reference directly.
• Write screenshot-helper output directly to unique chat media when a chat is available, avoiding disposable intermediate files.

Design notes

This deliberately removes the app-icon special case from viewed-image rendering: a source file inspection should show the exact bytes that were viewed, not whichever effective icon an owner override makes current. The package/apply boundary owns accepted assets; presentation code receives a usable reference rather than duplicating existence and cache-version rules.

Verification

• MOBIUS_TEST_RUNTIME=1 pytest -q backend/tests/test_app_apply.py backend/tests/test_apps.py backend/tests/test_apps_install.py backend/tests/test_validate_app_cli.py --tb=short — 221 passed on the review branch; 220 passed after reconciling the backend half with the newer live platform tree.
• npm test — 2,179 passed.
• npm run build — passed.
• Focused image-preview and icon frontend tests passed.
• Python compilation and git diff --check passed.
• A broader backend run reached an unrelated pre-existing time-window assertion that is already fixed in the live tree; the remaining broad run was stopped after continued clean progress. No failure from this change remained.

Prior work

PR #277 introduced native Codex image-view activity and was integrated in PR #304. This change completes its rendering path without exposing private files.

PR #321 is adjacent screenshot-settlement work. This contribution keeps capture settlement separate and focuses on output ownership, transcript rendering, and the app-icon lifecycle.