fix: the parity gaps the ECS matrices found, closed — Gemini's block is a refusal, a truncated reasoning-only turn commits nothing, images ride the regrouped stream

[gold-silver-copper]

Re-targets #2509 at main: that PR merged into ci/main-gate, so its change never reached main. This is its squash (0b7b215) cherry-picked onto main with no conflicts; the description below is #2509's.

Summary

The matrices of #2489–#2503 pinned five divergences "as they are" and ledgered them. This closes them in the runtime, one commit each, with the existing cell (or a new unit test where no wire can show it) as the regression. Stacked on #2508.

1. A provider's refusal of the prompt is a refusal on the report. Gemini's SAFETY / BLOCKLIST / PROHIBITED_CONTENT block was a plain provider error (kind: provider, refusal: false, no code). ProviderResponseError gains refusal (on the wire form, default false, read by every ErrorReport conversion that carries a reply); the block is now the provider's reply without a status, code the block reason, refusal: true. A refusal is never retryable, whatever status or transport verdict travels with it (is_retryable short-circuits; pinned). OTHER and unknown reasons stay transient and are not refusals. The row names the REST wire: rig-gemini-grpc does not read prompt_feedback yet, so a block on the gRPC wire is neither an error nor a refusal — deferred. A refusal the model says (OpenAI's refusal deltas) is an answer, as before. CONTRACT §4 gains the row; gemini::cassette::ecs_faults::refusal and the Gemini stream-fault blocked cells pin it.
2. A truncated reasoning-only turn commits nothing. rig-agent pushed the reasoning turn into history before the turn_delivered_no_answer check failed the run; rig-ecs keeps nothing. The check now runs first on both runtimes (CONTRACT §4); a_truncated_reasoning_only_turn_commits_nothing pins the run state. The bug: Gemini injects a hardcoded maxOutputTokens=4096 and temperature=1.0 into structured-output and image requests #2322 streaming test that pinned the old ordering in its name and doc asserted only that the streamed reasoning reaches the consumer, which is what keeps a truncated thinking turn debuggable; it is renamed partial_reasoning_reaches_the_consumer_when_the_truncated_turn_errors.
3. The streamed assembler carries image parts. A regrouped turn (a call or reasoning present) dropped any image the provider delivered. The assembler now applies rig-core's canonical_streamed_choice to its own inputs (its reasoning, the text items it reports, the calls it accepted, the images the provider delivered), so the two runtimes share one grouping rule: reasoning, text, the calls, then the images, each in arrival order.
4. The model-turn hook reads the reconciled finish reason — it already did. The compat normaliser, the streaming accumulator, the hook and the record all take the reconciled reason (stop beside a call is ToolCalls); a unit test pins it. The two Venice termination tool-turn cells stay ignored for what is now the real reason: their cassettes were removed as orphans in test(ecs): the ECS contract on five more wires — OpenAI Chat, OpenAI Responses, Gemini, DeepSeek, Doubleword, Venice #2501 and this task records none; the attribute names the two scenarios to record, after which the cells pass as written (every test(ecs): the ECS contract on five more wires — OpenAI Chat, OpenAI Responses, Gemini, DeepSeek, Doubleword, Venice #2501/test(ecs): the ECS contract under faults on six wires — setup, retryable statuses, truncated and error-bearing streams, refusals, failing tools, stops, scenes #2503 Venice tool turn reports tool_calls).
5. A typed tool error is a status: error result — not a gap. ErasedTool::execute renders every tool's Err into the result before the adapter answers; CONTRACT §8.1 says so in one sentence (an error map_error marks a refusal is status: refused instead).

No golden changed.

Testing

• cargo xtask verify --pr --base origin/main on this head: fmt, source-guards, tooling, clippy and default-check pass; default-tests ran 2530 tests with 2529 passed and one failure, llamacpp::cassette::loaders::loaders_smoke, which fails in this /private/tmp clone regardless of branch (the scrubber redacts only home-directory paths) and passes in CI. dependency-floors is outside the PR selection.
• The tree at this head is identical to the ci/main-gate head that fix: the parity gaps the ECS matrices found, closed — Gemini's block is a refusal, a truncated reasoning-only turn commits nothing, images ride the regrouped stream #2509 merged into (git diff is empty), so fix: the parity gaps the ECS matrices found, closed — Gemini's block is a refusal, a truncated reasoning-only turn commits nothing, images ride the regrouped stream #2509's own verification applies as written.

Changelog

• fix(gemini): a blocked prompt is a refusal on the report — ProviderResponseError::refusal, ErrorReport::refusal from a provider's reply, the block reason as the code.
• fix(agent): a truncated reasoning-only turn commits nothing (CONTRACT §4).
• fix(agent): the streamed assembler carries image parts after the calls, through rig_core::completion::message::canonical_streamed_choice.
• test(agent): the model-turn hook reads the reconciled finish reason.
• docs(ecs): a typed tool error is a status: error result.

Migration

ErrorReport::refusal is now true for a provider's refusal of the prompt (Gemini's content blocks), which arrive as kind: provider_response with the block reason as code instead of kind: provider; a caller matching Gemini's block on ErrorKind::Provider matches ErrorKind::ProviderResponse with refusal instead. ProviderResponseError gains a refusal field (set through with_refusal); is_retryable is false for a refusal regardless of status.