…law-dev#1296)

Implements tasks 1.1 + 2.x of the bound-image-egress change: the shared,
injectable IImageNormalizer that downscales an image to a bounded payload
(long-edge cap + base64 byte budget) and re-encodes once, with fail-loud drop.
No runtime wiring yet — this is the self-contained, fully-tested core.

- Add SkiaSharp 3.119.4 + Linux NoDependencies native asset (MIT; avoids
  ImageSharp's Six Labors Split License). Referenced from Netclaw.Media.
- ImageDecodeMath: pure ChooseDecodeSampleSize (drives JPEG/WebP shrink-on-decode
  so a full-res bitmap is never materialized) + Base64Length.
- SkiaImageNormalizer: scaled decode -> resize-to-cap -> JPEG quality ladder /
  size shrink to byte budget; opaque->JPEG, alpha->PNG; passthrough when already
  bounded; never throws (returns Dropped).
- 59 passing tests, fixtures generated in-test with SkiaSharp (no binaries).

Two design refinements found while building (documented in design.md):
- Memory bound is NATIVE (Skia heap), so the planned GC.GetAllocatedBytes
  assertion was dropped; the bound is proven via unit-tested sample-size +
  output-dimension assertions instead.
- Scaled decode is format-dependent (JPEG/WebP only); PNG/GIF/BMP get a
  fail-loud 256MiB decode ceiling (drop, don't OOM) rather than full decode.

…fig (netclaw-dev#1296)

Revises the change after verifying the file_read data flow in code:

- file_read images are NOT re-read from disk each turn. MaterializeModelInputFiles
  calls SessionMediaStore.CopyFile, persisting them into session media on first
  use — exactly like chat attachments (WriteDataContent). Both origins are read
  back via the single ChatMessageConverter egress path.
- Therefore the content-hash cache is redundant: normalize at the two
  SessionMediaStore writers and every image is bounded once at the source. Drop
  the cache (old task group 4) and collapse "two seams" to one.
- Drop runtime config: the byte budget is the memory-safety lever, so a
  user-raisable knob could re-open the OOM. Bounds are fixed constants; no
  netclaw-config.v1.schema.json change.

Net: removes a capability requirement, a task group, and the schema work; more
aligned with the memory-safety goal. The "-and-cache" in the change name is now
vestigial (noted in design Non-Goals). Strict validation passes.

…dev#1296)

Wires the image normalizer into the single media-store write boundary, so every
image bound for a model is bounded exactly once on write and the egress read path
never materializes an unbounded payload.

- WriteDataContent (chat attachments + persisted message media) and CopyFile
  (file_read model-input handoff) normalize images before writing; non-image
  media passes through untouched. The normalized artifact (PNG may become JPEG)
  replaces the original; the reference's length/MIME reflect it.
- CopyFile becomes nullable: a drop returns null, the caller skips it and the
  existing RequestedCount > MediaReferences.Count gap drives the model-input
  handoff warning — so a refused image is surfaced, not silent.
- Shared stateless SkiaImageNormalizer instance (no DI plumbing through the
  static call sites); fixed constant bounds (no runtime config).
- 6 seam tests: oversized chat/file_read image bounded; non-image passthrough;
  small image passthrough; undecodable image dropped + nothing written.

…law-dev#1296)

The media-store seam decodes every image on write, so fake magic-byte PNG stubs
are now correctly dropped as undecodable. Replace them with real, decodable
fixtures via a shared Netclaw.Tests.Utilities.TestImages helper:

- TestImages.SmallPng() — real opaque PNG small enough to pass through the
  normalizer byte-for-byte (round-trip assertions hold).
- TestImages.Image(w,h,...) — detailed image for downscale/budget fixtures.

Updated ChatMessageConverterTests, SessionToolExecutionPipelineTests,
LlmSessionImageDeliveryTests, SubAgentActorTests. Full Netclaw.Actors.Tests
suite green (2200), solution builds clean, slopwatch + headers pass.

…v#1296)

…tclaw-dev#1296)

Completes the fail-loud contract for the chat-attachment path. Previously a
dropped chat image (undecodable or un-boundable) returned null and vanished
silently; now WriteDataContent returns a MediaWriteResult that distinguishes a
silent skip (non-media/empty) from a drop carrying the reason.

- WriteDataContent -> MediaWriteResult { Reference?, DroppedReason? }.
- ChannelPipeline (inbound attachments) and ChatMessageConverter.FromAiMessage
  append a visible "[image omitted: <reason>]" note to the message content on a
  drop, so the model sees an attachment was present but couldn't be included.
- CopyFile (file_read path) unchanged — it still surfaces drops via the existing
  model-input handoff warning.
- Tests: converter appends the note + preserves text on drop; seam tests assert
  the reason is carried. Full Actors suite green (2201).

…1296)

…it (netclaw-dev#1296)

Adds a `netclaw doctor` check that fails loud if SkiaSharp's native
libSkiaSharp can't load — turning a packaging regression (the native asset
missing from the binary) into an up-front diagnostic instead of a runtime
throw deep in the channel/tool pipeline when the first image arrives.

- ImageNormalizerProbe.TryProbe() (Netclaw.Media): encode -> normalize
  round-trip; returns null on success or a short error. Keeps native usage
  encapsulated in the media library.
- ImageProcessingDoctorCheck (Netclaw.Cli): thin check that maps the probe to
  Pass/Error with remediation; registered alongside the other native-dep probe
  (sqlite).
- Netclaw.Cli.csproj: IncludeNativeLibrariesForSelfExtract=true so a manual
  `dotnet publish` of the CLI embeds libSkiaSharp (mirrors the daemon csproj;
  the release script already passes the flag to every component).

Docker (1.2): no Dockerfile change needed — self-contained single-file publish
with IncludeNativeLibrariesForSelfExtract embeds + self-extracts the native lib
(same mechanism as e_sqlite3); the single-binary COPY already carries it.

Tests: probe returns null with the real native lib; doctor check passes. All
143 Doctor tests green; solution builds clean; slopwatch + headers pass.

…claw-dev#1296)

…claw-dev#1296)

Group 5: evals not triggered (no identity/skill/tool-schema/memory/model change;
model-facing contract unchanged) and no checked-in benchmark warranted — the OOM
metric is native (Skia) memory, which BenchmarkDotNet's MemoryDiagnoser can't see,
and normalization is off the hot path. Recorded one-off before/after numbers in
design.md (e.g. 64MP source decoded bitmap 244MB -> 15MB; payload -> 123KB).

…ormat (netclaw-dev#1296)

Resolves the max-effort review findings:

- HIGH: the normalizer no longer throws. Normalize wraps its SkiaSharp calls in
  try/catch and returns Dropped (honoring the IImageNormalizer "never throws"
  contract), so a native-load failure / native OOM / malformed codec degrades to
  a per-image drop instead of faulting the whole tool turn or the channel
  ingestion stream.
- The normalizer now ONLY resizes and keeps the source container format — a PNG
  stays PNG, a JPEG stays JPEG. No PNG->JPEG transcode, no quality ladder, no
  iterative byte-shrink. Screenshots/diagrams keep their lossless fidelity.
- GIF (and any format Skia can't re-encode) passes through untouched when within
  the byte budget, else drops — animation is never silently flattened.
- Only model-input-eligible images are normalized; bmp/tiff (image but not
  model-input, never inlined) are stored byte-for-byte.
- Batch budget releases the over-reservation after CopyFile, so large-but-
  downscalable file_read images are no longer rejected on pre-resize source size.
- Enabled=false bypass returns a null MediaType so the caller keeps its declared
  MIME (was mislabeling JPEG/WebP as image/png).
- Cleanups: SKData.CreateCopy(span) drops a managed copy; drop-reason byte budget
  is formatted B/KB/MB (no more "0MB").

Media tests 62, Actors 2202, doctor probe green; solution builds clean.

…claw-dev#1296)