fix(gateway): skip workspace media fallback when explicit refs found

When splitMediaFromReply already extracted images from the agent's
markdown refs, skip the time-based appendRecentWorkspaceMedia scan.
The fallback was picking up stale files from previous turns whose
mtime got refreshed by sandbox mount/restart, causing all workspace
images to be sent to IM channels instead of just the referenced one.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: idoubi

internal/gateway/gateway.go

@@ -470,7 +470,13 @@ func New(env *config.EnvConfig) (*Gateway, error) {
 		// image-tool already saved the real file to /workspace. Dedupe
 		// by filename so we don't double-send anything
 		// splitMediaFromReply already resolved.
-		items = appendRecentWorkspaceMedia(ctx, g.workspace, task.AgentID, task.Message.ProjectID, task.Message.ChatID, turnStart, items)
+		// Skip fallback when splitMediaFromReply already extracted
+		// images — the explicit markdown refs are authoritative and
+		// the time-based scan can pick up stale files whose mtime
+		// was refreshed by sandbox mount/restart.
+		if len(items) == 0 {
+			items = appendRecentWorkspaceMedia(ctx, g.workspace, task.AgentID, task.Message.ProjectID, task.Message.ChatID, turnStart, items)
+		}
 		// Web-streamed turns already delivered the reply via the hub.
 		// Skip the outbound push entirely when there's no media; with
 		// media, push with empty text so attachments still flow but