fix(gateway): restrict auto-appended media to producer tools

[VinciZhu]

Summary

This PR prevents the gateway from auto-appending MEDIA: tags found in arbitrary tool results.

Previously, when the final response did not contain a media tag, the gateway scanned all current-turn tool/function output for MEDIA: strings and appended any matches to the final gateway reply. That is too broad: ordinary tools can return documentation, skill content, logs, search results, or user-authored text containing literal media examples.

For example, a docs/skill tool can legitimately return:

MEDIA:/absolute/path/to/file.png

That string is only documentation, but the old broad scanner treats it as a real attachment and may try to send a nonexistent file on any gateway platform.

The fix keeps the behavior intentionally narrow: automatic append only considers tool outputs from known media-producing tools (text_to_speech and the legacy text_to_speech_tool name). Future media-producing tools can opt in deliberately by adding their tool name to this list or by introducing a registry-level capability flag.

Fixes #16720

Changes

• Adds a small gateway helper for collecting auto-appended media tags.
• Maps tool results back to the assistant tool call that produced them.
• Stops scanning arbitrary tool/function output for media tags.
• Keeps existing auto-append behavior for real TTS media outputs.
• Adds regression coverage for documentation/skill examples and real TTS media artifacts.

Test plan

• Added regression coverage that skill_view output containing a MEDIA: example is not auto-appended.
• Added positive coverage that text_to_speech media output is still auto-appended, including the voice directive.
• Tested on macOS Darwin 25.3.0 arm64 with Hermes v0.11.0 local checkout.

venv/bin/python -m pytest tests/gateway/test_media_extraction.py -q

Result:

6 passed in 2.24s

Follow-up note

This PR intentionally avoids changing tool registration APIs. If maintainers prefer a more extensible design, the allowlist can be replaced in a follow-up with a registry-level capability flag such as auto_append_media=True on media-producing tools.

[kshitijk4poor]

Thanks @VinciZhu — salvaged into a batch PR alongside another related MEDIA: false-positive fix: #36275.

Your producer-tool allowlist commit was cherry-picked with authorship preserved. Since gateway/run.py had moved on a fair bit since this was opened (it gained the #34608 current-turn slice isolation and the #160 compression-safe fallback), the cherry-pick was reconciled to keep both of those and layer your allowlist on top as the primary guard, plus use the extension-anchored matcher already on main. Net behavior is strictly tighter with no regression. Also added you to the release AUTHOR_MAP so you're credited in the notes.

Closing in favor of #36275.