What does this PR do?

The send_message tool extracted MEDIA: directives, ran them through filter_media_delivery_paths (which silently drops paths outside the delivery allowlist), and then sent the remaining text. A successful text send was returned to the model as {"success": true} with no signal that the attachment had been stripped, so the agent reported "media sent" while the user only saw plain text — the exact failure reported in #32644.

This PR adds partition_media_delivery_paths on BasePlatformAdapter returning (safe, dropped). filter_media_delivery_paths keeps its old return shape by delegating to the partition (no behavior change for existing callers). send_message_tool._handle_send switches to the partition and, on a successful send, attaches a "MEDIA attachment(s) were dropped" warning plus a media_dropped: [...] field listing the rejected paths, so the agent can correct the path or expand HERMES_MEDIA_ALLOW_DIRS instead of treating text-only delivery as a fully successful attachment send.

Scope is intentionally narrow: this addresses acceptance criteria 1, 2, and the send_message half of 4 from the issue. The gateway post-stream delivery path in gateway/run.py::_deliver_post_stream_media also calls filter_media_delivery_paths and silently drops paths after text has already streamed; turning that into a user-visible follow-up message is a separate UX decision and is deferred to a follow-up PR. The operator-facing sendVoice/sendAudio smoke-test command (AC 3) is likewise deferred.

Related Issue

Refs #32644

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• gateway/platforms/base.py: add BasePlatformAdapter.partition_media_delivery_paths(media_files) -> (safe, dropped). Refactor filter_media_delivery_paths to delegate to it so existing callers keep their old return shape and per-path warning log.
• tools/send_message_tool.py: in _handle_send, use the partition helper and, on a successful send, attach a user-facing warnings entry plus a media_dropped: [<paths>] field so the model/operator sees that the attachment was filtered out. The warning is only added when the underlying send succeeded — error results are not mutated.
• tests/gateway/test_platform_base.py: add test_partition_returns_dropped_paths_so_caller_can_warn covering the new (safe, dropped) return shape under the strict allowlist.
• tests/tools/test_send_message_tool.py: the existing test_media_tag_outside_allowed_roots_is_not_sent now asserts that result["media_dropped"] and the warning are populated (it previously codified the silent-success bug). Add test_media_dropped_warning_not_added_when_send_errors so an upstream send failure isn't masked by the new warning.

How to Test

1. pytest tests/gateway/test_platform_base.py::TestMediaDeliveryPathValidation tests/tools/test_send_message_tool.py -q — 134 tests, all green locally.
2. End-to-end repro from Telegram MEDIA audio attachment can report success while delivering no attachment #32644: with HERMES_MEDIA_DELIVERY_STRICT=1 and HERMES_MEDIA_TRUST_RECENT_FILES=0, call send_message_tool({"action": "send", "target": "telegram:<chat>", "message": "[[audio_as_voice]]\nMEDIA:/tmp/outside-allowlist.ogg"}). The returned JSON now contains "media_dropped": ["/tmp/outside-allowlist.ogg"] plus a warnings entry naming the dropped attachment, instead of a bare {"success": true}.
3. Negative coverage: when _send_to_platform returns {"error": "..."}, the test confirms media_dropped is not attached — so a real send failure isn't masked.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/tools/test_send_message_tool.py tests/gateway/test_platform_base.py -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS 15 / darwin-arm64 (Python 3.11). No Windows footguns introduced — scripts/check-windows-footguns.py clean on the four touched files.

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — N/A, new method's docstring covers the behavior change and existing callers see no API change.
• I've updated cli-config.yaml.example if I added/changed config keys — N/A, no new config keys.
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — N/A.
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — change is pure Python list/tuple manipulation, no signals/subprocess/path-mode involved.
• I've updated tool descriptions/schemas if I changed tool behavior — N/A, the send_message schema is unchanged; the result dict gains an optional media_dropped field on success which is additive.

Addressing maintainer feedback

@alt-glitch noted (PR triage comment) that this competes with #32880, #32054, and #31864 — all targeting #32644 (silent MEDIA attachment drop):

• fix(tools): surface dropped MEDIA attachments in send_message result #32880 — send_message-only; the most focused of the four.
• fix(gateway): report skipped media attachments instead of silently dropping them #32054 — broader; also touches run.py and scheduler.py.
• fix(gateway): surface rejected media paths instead of dropping silently #31864 — restructures the filter_* return type across 13 call sites.

This PR sits between them: it adds partition_media_delivery_paths on BasePlatformAdapter and surfaces dropped paths in the send_message result, while keeping filter_media_delivery_paths' existing return shape (no change at its other call sites). Scope is intentionally limited to the four files above; the gateway post-stream path and the smoke-test command remain deferred (Refs #32644, not Closes). Happy to defer to whichever of the competing PRs the maintainers prefer — flagging the overlap here so the duplication is visible.