fix(agent): add image domain to tool-RAG classifier

[nsgds]

Summary

The tool-RAG domain classifier (_classify_agent_request) has no image/media domain, so
image requests classify to domains=[] → low_signal=True. On a fresh first turn
the direct low-signal reply path then offers the model no tools at all — "Draw a
picture of…" / "Create an image of…" deterministically fail with "I'm a text-based AI…"
(reproduced 4/4 phrasings on current dev; log signature below). On contextual turns,
image-tool inclusion is left to embedding-retrieval luck, and no "Image rules" pack is
ever injected (rules packs key off _DOMAIN_TOOL_MAP membership).

[agent-intent] latest='Draw a picture of a red fox...' low_signal=True domains=[]
[agent] direct low-signal reply path for latest='Draw a picture of a red fox...'

This is the same failure shape the integrations domain fixed for api_call (see the
in-code note citing #3794: "matched no domain, classified as low-signal, and the tool
never reached the schema filter"), and the fix has the same three-part shape as the
existing contacts/integrations domains:

• detection regex in _classify_agent_request (with lookbehinds so "docker image" /
  "disk image" stay out of the visual-media domain)
• _DOMAIN_TOOL_MAP["images"] = {"generate_image", "edit_image"} (deterministic seeding)
• _DOMAIN_RULES["images"] usage pack (also required: a _DOMAIN_TOOL_MAP key without
  a matching rules entry makes _domain_rules_for_tools raise KeyError)

Verified live (A/B on the same stack and model, fresh first-turn prompt): without this
commit the request is refused; with it, domains=['images'], low_signal=False, the
agent calls generate_image once and the image renders in chat. Companion PR #4123
covers the second, independent half of the linked issue (missing native tool schema);
this PR makes the tool reach the model deterministically, #4123 makes the call
first-class once it does.

Target branch

• This PR targets dev, not main.

Linked Issue

Fixes #3605

Type of Change

• Bug fix (non-breaking — fixes a confirmed issue)

Checklist

• I searched open issues and open PRs — this is not a duplicate.
• This PR targets dev
• My changes are limited to the scope described above — no unrelated refactors or whitespace changes mixed in.
• I actually ran the app (docker compose up) and verified the change works end-to-end. Type-checks and unit tests are not enough.

How to Test

1. Unit (deterministic string classifier — no DB/embeddings needed):
   python -m pytest tests/test_tool_rag_image_domain.py -q — covers: generation and
   edit phrasings resolve to the images domain and are never low-signal (including
   four fresh-first-turn phrasings observed failing live), the domain seeds both tools,
   the rules pack exists, and non-image / software-artifact prompts ("pull the docker
   image…") stay out.
2. Behavioral, on dev without this PR: open a new chat, agent mode, web search
   off, send "Draw a picture of a red fox sitting in a snowy forest." → the log shows
   low_signal=True domains=[] + direct low-signal reply path, and the model refuses.
3. With this PR, same request → domains=['images'], tool retrieval runs,
   generate_image is seeded, and (for models that act on the tool guide) the image
   generates and renders. Before/after screenshots in the comment below.

Visual / UI changes — REQUIRED if you touched anything that renders

Not applicable — backend classifier only (src/agent_loop.py + a test file); no
rendering code touched. The user-visible effect (image bubble instead of a refusal) is
shown in before/after screenshots attached in a comment.

[nsgds]

Rebased onto current dev to refresh CI — the branch had drifted behind. No content change: still just the images domain in _classify_agent_request plus its test.

Two notes for reviewers reconciling approaches:

• Opened a stacked follow-up (fix(agent): keep image tools armed for anaphoric follow-ups after an image turn #4124) for the anaphoric redo case this PR's keyword domain can't catch ("do another" / "try again" with no image keyword) — it re-arms the domain when a recent assistant turn actually used an image tool, so it's also language-agnostic.
• This area overlaps feat(media): add local-first media registry with ComfyUI generation routing #4014 (local-first media registry, which gates image tools via discovery) and fix(agent_mode): restore web tools for low-signal agent turns #3771 (restore tools on low-signal turns) — flagging so the directions can be reconciled rather than treated as duplicates.

[pewdiepie-archdaemon]

GitHub reports this PR is currently conflicting with dev, so I can’t review or approve it cleanly yet. Please rebase/update against current dev and rerun the focused tool/RAG classifier tests once it is mergeable again.

[nsgds]

Rebased onto current dev. The only conflict was the new contacts domain landing in the same three spots (_DOMAIN_RULES, _DOMAIN_TOOL_MAP, the detector) — kept both contacts and images. Reran the focused tool-RAG classifier tests (image + contacts + keyword-hint suites, all green) and the PR is mergeable again with CI passing.

[nsgds]

Sorry for the slow turnaround on this! Rebased onto current dev as requested — the
domain-registration spots remain the only overlap area (the new integrations domain
landed there since the last rebase; kept all). The focused classifier tests were rerun
and pass (7/7, tests/test_tool_rag_image_domain.py), plus a live A/B on a running
deployment (before/after screenshots below).

Two substantive changes since your last look, both from re-verifying live on current
dev:

• The detection regex missed one failing phrasing from my test set ("Paint a
  watercolor of…" — no image-noun in it). Added paint/paintings, dropped an
  unreachable second pattern (anything it matched already matched the first), and
  excluded "docker image"/"disk image" via lookbehinds. Term choice in these
  detectors is judgment — happy to trim if you'd rather keep the vocabulary
  minimal.
• Tests now pin the deterministic failure mode directly: four fresh-first-turn
  phrasings (observed failing 4/4 live) must never classify low-signal, since a
  low-signal first turn takes the direct no-tools reply path and cannot succeed
  regardless of retrieval.

Body rewritten to describe the failure as it behaves on current dev (the earlier
"retrieval is skipped" framing predates the low-signal retrieval changes). Full
two-defect analysis is in #3605; the native-schema half is #4123.

Before (stock dev, fresh first turn — refusal):

After (this PR only, same request — image renders):