fix(security): guard native image routing with file-safety policy

[teknium1]

Summary

Salvage of #58517 by @necoweb3 (cherry-picked onto current main, authorship preserved). Native image routing (agent/image_routing.py::_file_to_data_url) now honors the shared file-safety read guard before embedding local image bytes into outbound model requests — closing the path where a read-denied file (including an image-named symlink pointing at .env/auth.json) could be base64-embedded into a provider request.

Changes

• agent/image_routing.py: _file_to_data_url() calls raise_if_read_blocked() before read_bytes(). Blocked files are treated like unreadable attachments — logged, returned as skipped, turn continues. Guard failure itself no-ops (best-effort, consistent with the defense-in-depth framing).
• Regression tests: direct read-denied path, skipped native content parts, and the symlink-disguise case.

Validation

Check	Result
tests/agent/test_image_routing.py	97 passed, 0 failed
E2E (real imports, temp HERMES_HOME): .env with real PNG bytes, secret.png symlink → .env, direct auth.json	all blocked/skipped
E2E positive control: legit PNG	embeds, base64 round-trip byte-identical

11-line guard at the single byte-loading chokepoint used by build_native_content_parts (gateway native multimodal path). Same policy chokepoint as #57698 / #58709.

Closes #58517.

Infographic