fix: reject unsupported message files on typed Responses paths

[LOGO127]

Summary

Fixes #256.

• Preserve message input_file fields with InputContent::InputFile, reusing the existing typed file shape.
• Reject unsupported message files before storage work and after complete history rehydration. The public upstream_request preparation step checks the same contract for composable callers.
• Reuse the existing 400 invalid_request_error mapping across typed HTTP/streaming, WebSocket, local prewarm, and compaction paths. No inference is sent for rejected input, including files restored from durable history.
• Preserve eligible raw proxy request bytes, text/image content, and structured function/custom tool-output files. Document the distinction from Codex local file mentions/read tools.

No file upload endpoint, file-ID resolver, document parser, OCR, or new dependency. The added public enum variant may require downstream exhaustive matches to be updated.

This is an independent main-based fix. #257 touches the same rehydration function; its eventual integration must place validation in the shared rehydrate_with_continuation body, not only the no-session wrapper. A separate local combined candidate validates that resolution; its session-specific tests are not included in this standalone diff.

Test Plan

WSL Ubuntu x86_64, Rust 1.98.0, locked offline dependencies, local mock upstreams and isolated SQLite:

• Original main 74c6b2d with the 30 contract tests: 24 failures / 6 passing controls. Raw stored-history fixtures retain file JSON independently of deserialization.
• Fixed candidate: 30/30 contract tests passed.
• Full workspace/all features with --no-fail-fast: 909 passed / 9 ignored across 42 top-level test/doctest targets, excluding duplicate nested subprocess summaries.
• Workspace/all targets/all features Clippy with -D warnings, rustfmt, applicable seven-path pre-commit hooks, and whitespace checks passed.

The first full run hit one existing 11 MB body-limit test's connection reset. Its test and pre-deserialization handler code are unchanged; the focused rerun and the complete rerun passed. That observation is retained, not hidden or counted as a passing first run.

The ignored cases include eight PostgreSQL-specific tests and one existing doctest. No PostgreSQL, live model/GPU, MSRV, Python wheel/release or performance validation is claimed for this patch.

AI assistance was used for implementation and verification. The contributor reviewed the patch and created the DCO-signed commit fab52ff; the signed tree exactly matches the verified review snapshot.