fix(runner): 修复转存后残留二进制误判

统一结果二进制探测与上传规则，避免将 thinking_bytes 等上游元数据误判为待转存媒体，同时保留显式媒体字段和签名识别。\n\n补充不含原始内容的安全诊断，并兼容对象存储前缀旧字段；修正真实 OSS 验收脚本使用的正式字段。\n\n验证：Go 全量测试、go vet、迁移安全检查、真实 Gemini 上游响应及阿里云 OSS 转存均通过。

apps/api/internal/runner/binary_results_test.go

@@ -314,10 +314,13 @@ func TestHistoricalLocalBinaryStorageUnavailableDoesNotRetryProvider(t *testing.
 
 func TestTaskResultIgnoresLongOpaqueBase64Metadata(t *testing.T) {
 	opaque := base64.StdEncoding.EncodeToString([]byte(strings.Repeat("opaque metadata ", 400)))
-	result := map[string]any{"thought_signature": opaque}
+	result := map[string]any{
+		"thought_signature": opaque,
+		"thinking_bytes":    opaque,
+	}
 
 	if TaskResultHasInlineBinary(result) {
-		t.Fatal("opaque Base64 metadata must not be mistaken for generated media")
+		t.Fatal("opaque Base64 metadata, including bytes/buffer-style keys, must not be mistaken for generated media")
 	}
 }
 
@@ -328,6 +331,10 @@ func TestTaskResultDetectsLongBase64MediaWithoutSemanticKey(t *testing.T) {
 	if !TaskResultHasInlineBinary(result) {
 		t.Fatal("signature-detected generated media must still be materialized")
 	}
+	diagnostics := taskResultInlineBinaryDiagnostics(result)
+	if len(diagnostics) != 1 || !strings.Contains(diagnostics[0], "$.provider_payload") || !strings.Contains(diagnostics[0], "contentType=image/png") {
+		t.Fatalf("unexpected safe inline binary diagnostics: %+v", diagnostics)
+	}
 }
 
 func bytesToAny(payload []byte) []any {