No-images policy: refuse non-text fetches, drop image_search_tool

Agents in this build are text-only researchers. Image, audio, video,
and binary content has no role in the pipeline and only widens the
attack surface (server-side image fetches, exfiltration via rendered
img tags, etc). The cleanest answer is to never load it in the first
place rather than maintain a domain allowlist that nobody can keep
up to date.

- web_fetch_tool now uses httpx.AsyncClient.stream and inspects the
  Content-Type header BEFORE the body is read into memory. Only
  text/*, application/json, application/xml, application/xhtml+xml,
  application/ld+json, application/atom+xml, application/rss+xml are
  accepted; everything else (image/*, audio/*, video/*, octet-stream,
  pdf, font, missing header, ...) is refused with a wrap_untrusted
  error reply. The body bytes never enter the process for refused
  responses. Read budget is bounded to ~4x max_chars regardless.

- image_search_tool removed from deerflow.community.searx.tools
  (both the deer-flow runtime tree and the factory overlay). The
  function is gone, not stubbed — any tool.use referencing it will
  raise AttributeError at tool-loading time.

- config.yaml: image_search tool entry removed; the example
  allowed_tools list updated to drop image_search.

- HARDENING.md: new section 2.8 explains the policy and the frontend
  caveat (the LLM can still emit ![](url) markdown which the user's
  browser would render — that requires a separate frontend patch
  that is not yet implemented). Section 3.4 adds a verification
  snippet for the policy. The web_fetch entry in section 2.2 is
  updated to mention the streaming Content-Type gate.

Both source trees stay in sync.

config.yaml

@@ -75,11 +75,8 @@ tools:
     use: deerflow.community.searx.tools:web_fetch_tool
     max_chars: 10000
 
-  # Image search via SearX
-  - name: image_search
-    group: web
-    use: deerflow.community.searx.tools:image_search_tool
-    max_results: 5
+  # NOTE: image_search is intentionally NOT registered in this build.
+  # Agents are text-only researchers. See HARDENING.md sec. 2.8.
 
   # File operations (standard)
   - name: ls
@@ -128,7 +125,7 @@ guardrails:
       # Deny potentially dangerous tools
       denied_tools: []
       # Or use allowlist approach (only these allowed):
-      # allowed_tools: ["web_search", "web_fetch", "image_search", "read_file", "write_file", "ls", "glob", "grep"]
+      # allowed_tools: ["web_search", "web_fetch", "read_file", "write_file", "ls", "glob", "grep"]
 
 # ============================================================================
 # Sandbox Configuration