Fix unsupported standalone imagegen exposure

[andrei-hasna]

Summary

• hide the reserved image_gen.imagegen namespace outside Responses Lite so non-lite requests prefer hosted image_generation
• update the PR test: cover standalone imagegen request shape #258 characterization so it no longer canonizes the non-lite namespace exposure
• add serialized tool-list matrix coverage for auth, Responses Lite, ImageGenExt, namespace support, extension presence, and fail-closed behavior

Tests

• just test-fast -p codex-core hosted_tools_follow_provider_auth_model_and_config_gates (baseline on PR test: cover standalone imagegen request shape #258 before fix)
• just test-fast -p codex-core hosted_tools_follow_provider_auth_model_and_config_gates image_generation_serialized_tool_matrix_hides_reserved_namespace_when_unsupported
• just test-fast -p codex-core --test all responses_lite_uses_standalone_web_search_and_hides_unavailable_image_generation responses_lite_omits_hosted_tools_without_standalone_extensions non_lite_uses_hosted_web_search_and_hides_unavailable_image_generation
• just fmt
• just test -p codex-core (failed: broad existing/environment harness failures; touched image-generation tests passed)
• just fix -p codex-core

Secrets

• gitleaks protect --staged --config .gitleaks.toml --redact --no-banner before commit: no leaks found
• gitleaks protect --staged --config .gitleaks.toml --redact --no-banner before push: no leaks found

Stacked on PR #258 / task/bc0e6384-image-repro at fa299cf837b7b7f8001036914517bf41f5305704.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}