fix: stop the run when a provider rejects an attachment

[Im-Beast]

• A provider rejecting an attachment as unreadable now ends the run instead of switching models, since the next model fails on the same bytes
• Vertex's "Failed to decode image data" is now classified as attachment_rejected instead of a generic client error
• A provider failing to download the attachment URL now counts as a server error and retries, since our own fetch on other providers can still succeed