[alexandre-vl]

Fixes #1035. Refs #631 on desktop: its /tmp/… screenshot is outside the chat's folder, so it still shows as a link.

Two native ways for an agent to show a local image, both drawn as the image row Codex's generated images use.

show_image {path}	 in a reply

show_image (Zeron MCP) copies the file into uploads and publishes an image part, so desktop and iOS already render it and it outlives the file. PNG/JPEG/WebP/GIF by their bytes, ≤ 10 MB, ≤ 4096 px a side; a refusal says why. With real harnesses, Claude Code and OpenCode used it unprompted (4/4 and 6/6 images byte-identical); Codex defers MCP tools behind its tool search and writes Markdown instead.

Markdown images in an agent's reply are drawn in place, read live by the chat's host, never copied. No prompt or instruction mentions them. Refused paths keep today's rendering, a link:

• Nothing is fetched: URLs (http:, file:, data: …), ~, UNC and device paths are dropped before any request.
• ReadChatImageChunk {chatId, path} is answered only by the chat's host (relayed with targetDeviceId), strictly inside that chat's folder. A chat working in home or above, /, or around Zeron's data has none.
• Jailed lexically before any filesystem call; each component below the folder is lstated and a symlink or junction refuses unfollowed (a planted junction to \\host\share would send NTLM credentials). Windows device names are refused.
• A regular file (a FIFO is never opened), ≤ 10 MB, extension and first bytes agreeing; decoded within the shared 4096 px / 64 MiB limits, 4 reads at a time.
• The agent learns nothing back, so a reply can't probe which files exist.

Limits: the image follows the file (show_image copies); images outside the chat's folder (/tmp) or behind a symlink stay links; iOS still shows links.

• cargo test -p zeron-ui --lib: 1897 passed, incl. reply_markdown_images_draw_only_from_their_own_chat.
• cargo test -p zeron-engine --lib -- uploads:: rpc::tests::: 35 passed.
• cargo test -p zeron-engine --test e2e --test device_routing: 31 + 11 passed, incl. publish_image_lands_in_the_live_turn and chat_images_come_only_from_their_chats_own_folder.
• cargo test -p zeron-mcp: 36 passed.
• reply-images-fixture example + docs/screenshots/agent-images/ reproduce the captures.

---

^{Need help on this PR? Tag @codesmith-bot with what you need.}