[Codex][CLI] Gate image inputs by model modalities (#10271)

###### Summary

- Add input_modalities to model metadata so clients can determine
supported input types.
- Gate image paste/attach in TUI when the selected model does not
support images.
- Block submits that include images for unsupported models and show a
clear warning.
- Propagate modality metadata through app-server protocol/model-list
responses.
  - Update related tests/fixtures.

  ###### Rationale

  - Models support different input modalities.
- Clients need an explicit capability signal to prevent unsupported
requests.
- Backward-compatible defaults preserve existing behavior when modality
metadata is absent.

  ###### Scope

  - codex-rs/protocol, codex-rs/core, codex-rs/tui
  - codex-rs/app-server-protocol, codex-rs/app-server
  - Generated app-server types / schema fixtures

  ###### Trade-offs

- Default behavior assumes text + image when field is absent for
compatibility.
  - Server-side validation remains the source of truth.

  ###### Follow-up

- Non-TUI clients should consume input_modalities to disable unsupported
attachments.
- Model catalogs should explicitly set input_modalities for text-only
models.

  ###### Testing

  - cargo fmt --all
  - cargo test -p codex-tui
  - env -u GITHUB_APP_KEY cargo test -p codex-core --lib
  - just write-app-server-schema
- cargo run -p codex-cli --bin codex -- app-server generate-ts --out
app-server-types
  - test against local backend
  
<img width="695" height="199" alt="image"
src="https://github.com/user-attachments/assets/d22dd04f-5eba-4db9-a7c5-a2506f60ec44"
/>

---------

Co-authored-by: Josh McKinney <joshka@openai.com>

docs/contributing.md

@@ -41,6 +41,15 @@ If you are invited by a Codex team member to contribute a PR, here is the recomm
 3. **Document behavior.** If your change affects user-facing behavior, update the README, inline help (`codex --help`), or relevant example projects.
 4. **Keep commits atomic.** Each commit should compile and the tests should pass. This makes reviews and potential rollbacks easier.
 
+### Model metadata updates
+
+When a change updates model catalogs or model metadata (`/models` payloads, presets, or fixtures):
+
+- Set `input_modalities` explicitly for any model that does not support images.
+- Keep compatibility defaults in mind: omitted `input_modalities` currently implies text + image support.
+- Ensure client surfaces that accept images (for example, TUI paste/attach) consume the same capability signal.
+- Add/update tests that cover unsupported-image behavior and warning paths.
+
 ### Opening a pull request (by invitation only)
 
 - Fill in the PR template (or include similar information) - **What? Why? How?**

docs/tui-chat-composer.md

@@ -84,6 +84,9 @@ Key effects when disabled:
   `prepare_submission_text`.
 - When `slash_commands_enabled` is `false`, slash-context paste-burst exceptions are disabled.
 - When `image_paste_enabled` is `false`, file-path paste image attachment is skipped.
+- `ChatWidget` may toggle `image_paste_enabled` at runtime based on the selected model's
+  `input_modalities`; attach and submit paths also re-check support and emit a warning instead of
+  dropping the draft.
 
 Built-in slash command availability is centralized in
 `codex-rs/tui/src/bottom_pane/slash_commands.rs` and reused by both the composer and the command
@@ -252,6 +255,11 @@ Non-char input must not leak burst state across unrelated actions:
   inserting, deleting, flushing a burst, applying a paste placeholder, etc.
 - Shortcut overlay toggling via `?` is gated on `!is_in_paste_burst()` so pastes cannot flip UI
   modes while streaming.
+- Mention popup selection has two payloads: visible `$name` text and hidden
+  `mention_paths[name] -> canonical target` linkage. The generic
+  `set_text_content` path intentionally clears linkage for fresh drafts; restore
+  paths that rehydrate blocked/interrupted submissions must use the
+  mention-preserving setter so retry keeps the originally selected target.
 
 ## Tests that pin behavior