[codex] add content creation tools

[furukama]

Summary

Adds a first-class content creation stack to the container runtime:

• FAL / FLUX 2 image generation via image_generate
• OpenAI text-to-speech via text_to_speech / tts
• Whisper transcription via audio_transcribe / transcribe_audio
• vision as a first-class alias for vision analysis
• Mermaid / SVG diagram generation via diagram_create / diagram

Why

HybridClaw already had pieces of media support, but content creation and vision were not exposed as a coherent built-in tool surface. This change makes image generation, speech, transcription, and diagrams available as first-class tools with host-side secret resolution and worker-safe IPC handling.

Implementation Notes

• resolves FAL_API_KEY and OPENAI_API_KEY on the host and passes redacted content tool config through ContainerInput
• adds worker-signature inputs so runtime changes restart persistent workers when content-tool config changes
• classifies the new tools in approval policy and normalizes placeholder chat results for generated outputs
• expands artifact MIME handling for generated audio and Mermaid files
• adds focused tests for tool execution, worker signatures, IPC redaction, approval policy, chat result handling, and artifact inference

Validation

• npm run typecheck
• npm --prefix container run lint
• npm run build
• npx vitest run tests/approval-policy.test.ts tests/chat-result.test.ts tests/container.artifacts.test.ts tests/worker-signature.test.ts tests/content-tools.test.ts

Known Issue

• tests/ipc.test.ts is currently blocked in this checkout because local better-sqlite3 was compiled for NODE_MODULE_VERSION 127 while the active Node runtime expects 141.