fix(runner): 修复转存后残留二进制误判

统一结果二进制探测与上传规则，避免将 thinking_bytes 等上游元数据误判为待转存媒体，同时保留显式媒体字段和签名识别。\n\n补充不含原始内容的安全诊断，并兼容对象存储前缀旧字段；修正真实 OSS 验收脚本使用的正式字段。\n\n验证：Go 全量测试、go vet、迁移安全检查、真实 Gemini 上游响应及阿里云 OSS 转存均通过。

apps/api/internal/runner/upload_test.go

@@ -348,6 +348,7 @@ func TestFinalizeGeneratedAssetsMaterializesDetectedMediaAndKeepsOpaqueMetadata(
 	result := map[string]any{
 		"provider_payload":  base64.StdEncoding.EncodeToString(payload),
 		"thought_signature": opaque,
+		"thinking_bytes":    opaque,
 	}
 
 	finalized, err := service.finalizeGeneratedAssets(
@@ -373,6 +374,43 @@ func TestFinalizeGeneratedAssetsMaterializesDetectedMediaAndKeepsOpaqueMetadata(
 	if finalized["thought_signature"] != opaque {
 		t.Fatal("opaque provider metadata must remain unchanged")
 	}
+	if finalized["thinking_bytes"] != opaque {
+		t.Fatal("opaque provider bytes metadata must remain unchanged")
+	}
+}
+
+func TestFinalizeGeneratedAssetsMaterializesGeminiImageData(t *testing.T) {
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { w.WriteHeader(http.StatusOK) }))
+	defer server.Close()
+	service := &Service{}
+	channels := []store.FileStorageChannel{testObjectStorageChannel("s3", server.URL, "s3-result")}
+	payload := append([]byte{0x89, 'P', 'N', 'G', 0x0d, 0x0a, 0x1a, 0x0a}, bytes.Repeat([]byte{0}, 256)...)
+	result := map[string]any{
+		"id":      "gemini-image",
+		"created": float64(1),
+		"model":   "gemini-3-pro-image",
+		"data": []any{map[string]any{
+			"b64_json":  base64.StdEncoding.EncodeToString(payload),
+			"mime_type": "image/png",
+		}},
+	}
+
+	finalized, err := service.finalizeGeneratedAssets(
+		t.Context(), "task-gemini-image", "images.generations", result,
+		defaultGeneratedAssetUploadPolicy(), channels, true, 0,
+	)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if TaskResultHasInlineBinary(finalized) {
+		t.Fatalf("Gemini image result still contains inline binary: %+v", taskResultInlineBinaryDiagnostics(finalized))
+	}
+	data := finalized["data"].([]any)
+	item := data[0].(map[string]any)
+	reference, ok := item["b64_json"].(map[string]any)
+	if !ok || reference["assetRef"] == nil || reference["upload"] == nil {
+		t.Fatalf("Gemini b64_json was not replaced by an object reference: %#v", item)
+	}
 }
 
 func TestResolvedGeneratedAssetContentTypePrefersDetectedMedia(t *testing.T) {