fix(runner): 修复图像结果转存与任务租约失效

修正非语义字段长 Base64 元数据被误判为媒体的问题，并允许按文件签名识别真实媒体后转存 OSS；同时将网关本地存储失败与上游失败分离，避免重复调用和错误降权。

异步任务复用已分配并发名额前立即刷新租约，租约已丢失时重新排队获取，避免排队耗时侵蚀租约后错误调用上游。生产环境关闭 server-main 尚未实现的进度回调，保留 Gateway 任务详情与事件查询。

验证：API 全量 go test、go vet、gofmt、Kubernetes 渲染、迁移安全检查及真实阿里云 OSS 读写/生命周期验收通过。

apps/api/internal/runner/upload_test.go

@@ -338,6 +338,43 @@ func TestFinalizeGeneratedAssetsUploadsNestedInlineBinaryUnderDefaultPolicy(t *t
 	}
 }
 
+func TestFinalizeGeneratedAssetsMaterializesDetectedMediaAndKeepsOpaqueMetadata(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusOK) }))
+	defer server.Close()
+	service := &Service{}
+	channels := []store.FileStorageChannel{testObjectStorageChannel("s3", server.URL, "s3-result")}
+	payload := append([]byte{0x89, 'P', 'N', 'G', 0x0d, 0x0a, 0x1a, 0x0a}, bytes.Repeat([]byte{0}, 4096)...)
+	opaque := base64.StdEncoding.EncodeToString([]byte(strings.Repeat("opaque metadata ", 400)))
+	result := map[string]any{
+		"provider_payload":  base64.StdEncoding.EncodeToString(payload),
+		"thought_signature": opaque,
+	}
+
+	finalized, err := service.finalizeGeneratedAssets(
+		t.Context(),
+		"task-provider-payload",
+		"images.generations",
+		result,
+		defaultGeneratedAssetUploadPolicy(),
+		channels,
+		true,
+		0,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if TaskResultHasInlineBinary(finalized) {
+		t.Fatalf("finalized result still contains generated media: %#v", finalized)
+	}
+	reference, ok := finalized["provider_payload"].(map[string]any)
+	if !ok || reference["assetRef"] == nil || reference["upload"] == nil {
+		t.Fatalf("detected media was not objectified: %#v", finalized["provider_payload"])
+	}
+	if finalized["thought_signature"] != opaque {
+		t.Fatal("opaque provider metadata must remain unchanged")
+	}
+}
+
 func TestResolvedGeneratedAssetContentTypePrefersDetectedMedia(t *testing.T) {
 	pngPayload := []byte{0x89, 'P', 'N', 'G', 0x0d, 0x0a, 0x1a, 0x0a, 0, 0, 0, 0}