fix(chat): publish generated PNG without forbidden file URL navigation

## Problem

In the browser acceptance scenario that creates a Word file, an Excel file, and then a PNG in one conversation, the Word and Excel files publish successfully but the PNG turn fails after generation.

The run generates `/workspace/launch-flow.png`, then calls `browser_navigate` with `file:///workspace/launch-flow.png`. The browser contract correctly rejects local file URLs before Playwright execution, so the generated PNG is never published.

## Expected behavior

After generating a PNG, the runtime should validate it through the supported workspace image/file path and continue to `wx_artifact_publish`. Browser navigation should only be used for supported public HTTP(S) URLs or the existing isolated HTML preview URL.

## Acceptance

- The original three-turn browser scenario produces three distinct downloadable artifacts.
- PNG verification does not request a forbidden `file://` browser navigation.
- A failed optional preview does not prevent publishing an already valid generated file.
- Regression coverage proves Word, Excel, and PNG outputs remain independent in one conversation.

Source: WorkspaceX browser acceptance T15 from #3413.

Start with the browser contract and the runtime path that handles the generated /workspace/launch-flow.png before wx_artifact_publish; compare it with the existing HTML preview and supported workspace image/file handling. Re-run the WorkspaceX browser acceptance T15 scenario and add regression coverage showing independent Word, Excel, and PNG artifacts without file:// navigation.

Written by the indexing model from the issue text.