fix: address three reproducible issues from September triage

[1jehuang]

Summary

Three small fixes from the newest-50 issue triage, with one issue-referencing commit each. Unrelated local changes and local-only base commits are excluded. No contributor branch was imported.

Issue	Fix	Observed verification
#1234	Return an empty session list before zero-sized chunking	Regression reproduced the reported panic before the fix. All 113 bridge tests passed. The exact published bridge build passed real isolated socket hello → list_sessions → ping → create_session checks for missing, empty, and filtered-only directories.
#1223	Forward the registered Bash definition through Anthropic OAuth instead of replacing it with a drifting curated schema	Regression failed before the fix. All 21 Anthropic crate tests passed. Tests preserve millisecond documentation, execution options, OAuth naming, one advertisement, and cache marking. No timeout alias or unit reinterpretation was added.
#1221	Permit image input only for the three reported DeepSeek Flash aliases on the DeepSeek profile	Two new regressions failed before the fix. All 13 focused tests passed, including actual captured HTTP request payloads to a local fixture. Pro, unknown models, ZAI, and explicit per-model overrides remain conservative or retain their configured behavior.

Validation boundaries

• Exact published head e2b9d7a1aeae7f0e951af6328ce1e58c13d27cff passed all three affected crate suites: 268 passed, 0 failed, 1 ignored (113 bridge, 21 Anthropic, 134 compatible-runtime). Its complete TUI/CLI selfdev build also passed. All 1,898 tracked source blobs still matched the published Git tree after testing. This is not a full workspace CI run.
• Repeated the real-socket check using the newly built exact-snapshot CLI for both serve and api-bridge. All three directory layouts passed hello → list_sessions → ping → create_session on one connection. Private homes/sockets and owned-process cleanup were used. No shared daemon was restarted/reloaded and no model inference was requested. The archive build reports v0.84.0-dev (unknown) because it has no .git, so identity was established by source-blob verification and binary SHA-256 5fc1d981ca943f52ff22e2cadc9277b12381f38b7108cb02ef299843149c692a, not its version string.
• DeepSeek server-side vision support relies on the reporter's direct-API evidence. No live DeepSeek or Anthropic OAuth inference was performed. The tests verify local capability/schema handling and emitted image payloads, not vendor behavior or future model choices.
• CI is actually failing, not merely pending. The CI workflow, Windows smoke, and iOS workflow failed before jobs. The default branch retains duplicate top-level env maps tracked by CI broken since Aug 20: duplicate top-level env in ci.yml, ios-testflight.yml, windows-smoke.yml (Invalid workflow file) #1191 / existing PR fix: safe fixes from September 7 issue triage #1193. Only Require Linked Issue passes in the PR check rollup. This remains draft until that baseline workflow repair and full checks are resolved. Existing PR fix: address ten reproducible issues from September triage #1218 owns ten other triaged fixes and is not imported here.
• Existing formatting defects outside the new regression region remain in translate_tests.rs. Patch whitespace checks pass. No whole-workspace formatting pass is claimed.
• No issues were closed, and no PRs were merged.

Fixes #1234
Fixes #1223
Fixes #1221

---

— Jcode agent (automated triage), on behalf of @1jehuang