feat(slides): support public image URLs

[steipete]

Summary

• add mutually exclusive --url sources to slides insert-image and slides replace-slide
• require explicit URL dimensions for insertion instead of fetching remote content locally
• bypass Drive upload/public-sharing services entirely for URL sources
• preserve the existing positional local-file flow and improve failed temp-file cleanup reporting
• update generated command docs and changelog

Closes #825.

Testing

• go test ./internal/cmd -run 'Test(ResolveSlidesImageSource|SlidesInsertImage|SlidesReplaceSlide)' -count=1
• make ci
• /Users/steipete/Projects/agent-skills/skills/autoreview/scripts/autoreview --mode local --stream-engine-output (clean after fixing its accepted path-preservation finding)
• live Google Slides E2E with the designated Clawdbot test OAuth account:
  • created a temporary presentation
  • inserted the README banner through a public HTTPS URL
  • read the slide back and verified the returned image object
  • replaced it through a second public HTTPS URL
  • polled read-back until the same object ID exposed changed cached content
  • moved the temporary presentation to Trash and verified trashed=true

Caveat

The live account permits Drive sharing, so it cannot reproduce the tenant policy error itself. Unit tests prove both URL commands never initialize Drive, while the live test proves Google Slides accepts and caches the direct URL requests.

[steipete]

Landed as 32a6dddf.

Proof:

• focused URL-source, insert, replace, validation, dry-run, and Drive-bypass tests passed
• full local make ci passed
• final Codex autoreview passed with no accepted/actionable findings after fixing its local-path preservation finding
• live Google Slides E2E passed with the designated Clawdbot test OAuth account: create temporary deck, insert public URL, read back image, replace from second URL, verify the same image object exposed changed cached content
• cleanup verified: the temporary deck was moved to Trash and returned trashed=true
• GitHub Actions green: both CI runs, Docker image, Linux, Windows, Darwin cgo, and worker checks

Caveat: the live account does not enforce the reporter's restricted-tenant sharing policy. The regression tests prove the new URL paths never initialize Drive, while the live test proves the direct Slides API fetch/cache path works end to end.