feat(tui): unify image presentation across message origins

[danielkov]

Summary

Unifies TUI image presentation for user attachments, native assistant-generated images, typed tool results, and parsed Markdown image nodes. Shares asynchronous decoding, terminal protocols, resource limits, and live/replay behavior without attaching displayed media to model context.

Stacked on #129; this PR intentionally targets feat/compose-files-phase-3.

Impact

Assistant-generated images now retain pixels in the transcript instead of becoming text-only placeholders. Authorized Markdown images load only when visible, with alt/source fallbacks, stable viewports, and message-local content deduplication that preserves repeated Markdown occurrences.

Technical details

• Managed URLs require current-session authority. Local paths follow OS permissions and bounded regular-file reads; external references are temporary presentation snapshots, not managed imports.
• Remote loading is disabled by default. KIT_TUI_IMAGE_ORIGINS explicitly authorizes exact HTTPS origins; every DNS address must be public and is pinned while TLS hostname verification remains active. Redirects, ambient proxies, cookies, and credential-bearing URLs are excluded.
• Source acquisition and decoding use independently bounded worker admission. Cancellation stops stale async stages while actual blocking work retains its admission permits. Source-specific invalidation avoids rebuilding unrelated Markdown history.
• Adds the audited, feature-minimal pulldown-cmark =0.13.0 parser and its sole new transitive dependency, unicase =2.9.0; no other dependency versions change.

[danielkov]

Local verification for 8fa7932932d6cc2a87a04fe61cf468e2bb2472f5:

• cargo fmt --check, release-version script tests, and cargo clippy --locked --all-targets --all-features -- -D warnings passed.
• cargo test --locked passed: 1,250 library tests plus binary/integration suites; 8 opt-in tests ignored. One prior run hit the existing filesystem lease test's WouldBlock failure; both its isolated rerun and the subsequent complete suite passed.
• Explicit opt-in HTTPS smoke passed against https://httpbin.org: authorized image acquisition and redirect rejection through the production resolver.
• Seven Swift generator tests and generated ACP drift check passed.
• Independent exact-SHA review approved this head after resolving cancellation, occurrence-admission, and targeted-invalidation findings. Configured GitHub review and CI are running separately.

Coverage includes typed user/tool/assistant live and replay transport, completed versus partial Markdown nodes, managed session authority, local permissions/symlinks/FIFOs, rejected remote origins/nonpublic addresses, response limits/redirects, stale-task cancellation, corrupt formats, pixel/source budgets, cache/resize/fallback, content-exact deduplication, and text-only search/copy behavior.

Presentation evidence uses real TestBackend rendering and the shared halfblock protocol, including visible colored image cells. No physical Kitty/iTerm2/Sixel terminal demo was recorded; protocol behavior beyond the exercised backend remains dependent on terminal support. Mutable external references are intentionally re-resolved after reset/replay, and blocking OS/codec work cannot be forcibly interrupted even though admission remains bounded.

This stack remains unmerged. Base is feat/compose-files-phase-3 at eeedaffc740148c0cad0a361c0e5b2b82a6f4517 (#129).

[kit-code-agent]

No issues found. The changes look good to merge.

[kit-code-agent]

Two image-loading correctness issues remain: URL-escaped local Markdown destinations are interpreted as literal filenames, and aggregate source-cache pressure leaves otherwise valid images negatively cached instead of reclaiming older snapshots.

[kit-code-agent]

Byte-pressure eviction can repeatedly reacquire still-visible Markdown images when their combined snapshots exceed the source-cache budget, causing repeated I/O, decoding, and loading-placeholder churn without user interaction.

[kit-code-agent]

A simultaneously visible image set exceeding the source-cache byte budget causes continuous eviction and reacquisition, including repeated downloads for authorized HTTPS sources.

[kit-code-agent]

No issues found. The changes look good to merge.

[kit-code-agent]

No issues found. The changes look good to merge.

[kit-code-agent]

No issues found. The changes look good to merge.