hal-image: agent-safe image handling

One tool does almost everything: magick (ImageMagick) reads metadata and resizes / crops / rotates / converts / combines / watermarks images. One extra tool, oxipng, does best-in-class lossless PNG compression. Together they let an agent process and deliver images without bloating tokens or stalling uploads.

Core discipline

1. Compress before you deliver. Before attaching/uploading/sending any image, run it through lossless compression (below). A 2 MB screenshot becomes ~0.7 MB with zero pixel change — saving multimodal tokens and avoiding slow/aborted transfers.
2. Never expose local paths to the user. Work with files locally, but the message to the user references the image itself, not /Users/.../~/....
3. Fail open. This is a helper, not a gate. If magick/oxipng is missing or a command errors, pass the original image through and continue — never block the task on image tooling.