fix: remove local filesystem reads from flaunch and zora providers

[CarsonRoscoe]

Description

Both providers treated any non-URL image string as a local filesystem path, read it with fs.readFile, and uploaded the bytes to a third-party IPFS pinning service (web2-api.flaunch.gg and Pinata respectively), which pins them publicly. Because image is an LLM-supplied tool argument whose description explicitly advertised "Local image file path", an agent could be induced to read an arbitrary file off the host and publish it.

The local-file affordance is not useful to an agent, which has no knowledge of the host filesystem. It only ever served direct programmatic SDK callers, who can perform the read themselves.

• flaunch: image accepts http(s):// URLs or data: URIs
• zora: image accepts https:///ipfs:// URIs or data: URIs
• Anything else is rejected before any file or network access
• Zod schemas reject non-URL values, so the constraint is also visible to the model rather than surfacing only as a runtime error
• Tool/schema descriptions and READMEs no longer advertise local paths

Callers publishing a local file now pass a data URI:

image: `data:image/png;base64,${fs.readFileSync(p, "base64")}`

Tests

Manually tested and verified

Checklist

A couple of things to include in your PR for completeness:

• Added documentation to all relevant README.md files
• Added a changelog entry

[cb-heimdall]

🟡 Heimdall Review Status

Requirement	Status	More Info
Reviews	🟡 0/1	Denominator calculation Show calculation 1 if user is bot 0 1 if user is external 0 2 if repo is sensitive 0 From .codeflow.yml 1 Additional review requirements Show calculation Max 0 0 From CODEOWNERS 0 Global minimum 0 Max 1 1 1 if commit is unverified 0 Sum 1