fix(remote): deliver session-owned images and files across clients

[bobleer]

Summary

Generated images and file links now resolve through the session and host that produced them. Mobile web can display output images inline, native mobile can preview and download the complete file, IM bots return remote replies and attachments, and Detached Dispatch supports binary previews and downloads.

Type and Areas

Type: bug fix / UI/UX / compatibility

Areas: session output routing, Remote Connect, IM bots, Detached Dispatch, CLI, Web UI, mobile web, Android/iOS shared core, HarmonyOS, docs.

Motivation / Impact

A reply such as ![Preview](computer://preview.png) previously depended on the viewer's current workspace, could disappear on another client, or arrive as a truncated image. Account-device bot submissions also stopped at submission instead of returning the result to the chat.

• Resolve files through the originating session's execution root, worktree, or runtime artifact root. Use its filesystem provider for SSH; missing sessions/providers fail explicitly without reading a same-named controller file.
• Reassemble bounded binary chunks as bytes, validate offsets, lengths, and metadata, and compare optional file revisions. Fence in-flight reads and bot authority across device/account changes.
• Follow the accepted remote turn through reconnects, relay questions and approvals to its captured target, and send final replies plus native image/file attachments. Parse actual Markdown references, deduplicate image/link pairs, and ignore code examples.
• Negotiate the optional query_file_chunks_v1 capability for dispatch output. Keep older targets' execution and text queries working. Open binary images and text snapshots as immutable content, refresh reopened results, and avoid controller file IO/watchers.
• Integrate with the upstream workbench ownership changes, prevent image-viewer retry loops, and display the actual image byte size. Retire completed remote prompts so answers supplied on another client do not capture the next bot message.

Verification

Passed locally:

• cargo test --locked -p openbitfun-services-integrations --no-default-features --features remote-connect --lib remote_connect:: — 117 tests.
• cargo test --locked -p openbitfun-services-integrations --no-default-features --features remote-connect --test remote_connect_contracts — 64 tests, including legacy file-chunk round trips.
• cargo test --locked -p openbitfun-core --no-default-features --features remote-connect --lib service::remote_connect::bot:: — 46 tests, including encrypted account-RPC loopback, disconnect/replay, captured-target questions/approvals, multi-chunk attachment reads, and retirement of completed prompts without dropping other queued questions.
• Focused Web UI tests for Markdown, dispatch navigation/downloads, ImageViewer, mobile output routing, and EditorDocument — 116 tests; the workbench guide's seven-file suite — 97 tests after the immutable-preview integration fix.
• Shared Kotlin :core-feature:jvmTest --tests '*RemoteWorkspaceStoreTest' :core-protocol:jvmTest and HarmonyOS local tests passed, including changed revisions, padded chunks, incomplete transfers, and target switches.
• pnpm run check:web, pnpm run type-check:mobile-web, pnpm run i18n:audit, pnpm run check:core-boundaries, pnpm run mobile:architecture, pnpm run check:repo-hygiene, Rust formatting, full Web UI ESLint, and git diff --check passed.
• Earlier focused checks in this branch also passed: dispatch controller and CLI durable-job binary query tests, session-file confinement tests, native message-reference projection, iOS pure Swift checks and simulator build, and compact/desktop image fallback/retry/download visual checks.

Remote-scenario evidence: SSH output routing/confinement is covered through an injected remote filesystem provider; Remote Connect uses real encryption and HTTP loopback with simulated target responses; Peer Device Mode covers surface identity changes; Detached Dispatch covers persisted job ownership, optional capability negotiation, and revision-bound continuation. Live SSH/IM-provider delivery and physical native/foldable-device UX were not exercised.

Reviewer Notes

Persisted records remain compatible. The Remote Connect chunk revision is optional, and legacy replies remain readable. Dispatch protocol version stays unchanged; binary queries require the separately advertised capability. Existing providers without revision metadata retain legacy checks. Remote paths through symlinks fail explicitly until the filesystem provider can establish canonical confinement.

The protocol suite also contained a stale minimal assertion after the upstream canonical agent-identity migration; it now checks Minimal and the uppercase legacy alias, matching the existing runtime contract.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.