Support Cloud image messages and editable draft handoffs (#60061)

## Why

Cloud messages previously accepted only plain text, and switching a draft to Cloud waited for session preparation without processing composer input.

## What changed

- Support ordered text and image parts in Cloud submissions and user-message summaries, preserving attachment placeholders, image detail, and client message IDs.
- Accept inline data URLs and uploaded file IDs, including image-only messages. Reject invalid references and text spans locally, and cap encoded image requests at 3.75 MiB while retaining the existing plain-text limit.
- Keep the composer editable and redraw the TUI while Cloud prepares a conversation. Carry the latest draft, attachments, and Vim mode into the destination, retain drafts on failure, and prevent submission to the outgoing session during the handoff.
- Preserve buffered paste input and pending clipboard reads across the handoff, with connection and failure hints.

## Testing

Add regression coverage for image wire encoding, receipt identity, validation and size boundaries, draft editing during successful and failed handoffs, clipboard completion, Vim state, and attachment recovery after rejected submissions.

GitOrigin-RevId: 0cbcde0ab89ba961780b5f88456057e6b6a19cd5

codex-rs/cloud-client/README.md

@@ -60,7 +60,19 @@ notifications and uncertain overlap require authoritative history reload. This
 crate exposes the read primitives; a coordinated resync/display state machine is
 still required before claiming lossless resume or live/history reconciliation.
 
-`add_user_message` submits plain text using the thread's existing configuration.
+`add_user_message` submits ordered text and image parts using the thread's existing
+configuration. Use `UserMessageInput::Text` or `UserMessageInput::Image` with an
+`ImageReference::Url` (inline data URLs only) or `ImageReference::FileId` and optional
+`ImageDetail`. Image-only input is supported; local paths must be converted by the
+caller before submission. URL prefixes are case-insensitive and must contain
+nonempty data; HTTP image URLs are rejected locally because the backend would
+omit them. File IDs must be nonblank. Requests containing images have a 3.75 MiB
+encoded-envelope cap, reserving 256 KiB below CCA's 4 MiB forwarding limit. Plain
+text retains the 64 MiB encoded-message limit. Text parts carry optional UTF-8
+byte spans through `UserMessageTextElement`; empty span lists preserve the plain
+text wire encoding. User-message summaries retain ordered content and client IDs
+for both text and image echoes.
+
 Choose `StartIfIdle`, `Steer`, or `Queue` explicitly; admission distinguishes
 started, steered, duplicate and queued results. Persist a unique client message ID
 with each logical input and keep it unchanged when reconciling an uncertain
@@ -75,8 +87,8 @@ sending. `OutcomeUnknown` retains the source error: even a server error can foll
 admission, so status codes alone do not prove rejection. Malformed success replies
 and mismatched response IDs are also uncertain. No automatic retry is performed;
 dropping a pending call does not undo remote work. Reconcile with server state
-before deciding whether another attempt is safe. Full input/configuration overrides
-and automated outcome reconciliation are not implemented by this text-only slice.
+before deciding whether another attempt is safe. Other input kinds, configuration
+overrides and automated outcome reconciliation are not implemented.
 
 The attach example accepts two optional additional arguments to explicitly send
 one message after attaching: a persisted client message ID and the text. It uses