feat(image-gen-fal): port the fal.ai image tool to a WIT component plugin

[JordanTheJet]

The image_gen_fal tool has had no source in this repo. It was developed under plugins/image-gen-fal in the zeroclaw tree, moved out by "chore(plugins): move example plugins out of the main tree", then deleted outright by #8137 ("scope plugin config per-alias and remove raw env access"). Only the compiled image-gen-fal-0.1.0.zip survived as a release asset — the capability existed with nothing maintainable behind it. This restores it here, where it belongs.

Not a copy — a port

The 0.1.0 source targeted the retired extism ABI (#[plugin_fn], zc_env_read, zc_http_request). This rewrites it against the tool-plugin world in wit/v0, following redact-text as the reference:

• Credentials move from environment to config. 0.1.0 read FAL_API_KEY from the process environment. #8137 removed raw env access from plugins, so the key now comes from this plugin’s own jailed config section, injected into execute args as __config. The manifest requests config_read rather than env_read — which now survives only as a serde alias for ConfigRead. Breaking for 0.1.0 users, hence 0.2.0 plus a migration note in the README.
• HTTP moves to wasi:http via waki, replacing the host-function shim.
• Pure logic split into src/fal.rs with no wasm dependency, so it is host-testable with a plain cargo test; src/lib.rs is a thin component shim.

Behavior preserved from 0.1.0

Same tool name, parameters and defaults, the same https://fal.run/<model> contract, the same /images/0/url extraction, and the same model-identifier validation blocking .., ?, #, \, and a leading / from reaching the request URL. Upstream error bodies are still clipped to 500 chars so an HTML error page cannot flood the agent’s context.

Verification

• 17 host tests — argument defaulting/validation, config-based key resolution (including asserting the error does not send operators back to the removed env flow), response parsing, truncation, schema.
• Builds clean to a wasm32-wasip2 component: 317 KB, layer 1, exports zeroclaw:plugin, imports wasi:http.
• clippy clean.

registry.json is intentionally untouched — the publish workflow generates it.

Follow-up (not in this PR)

Removing zeroclaw-tools/src/image_gen.rs from core is a separate zeroclaw PR. It touches config/schema.rs (ImageGenConfig, the [image_gen] section and fixture), so by convention it is milestoned v0.9.0; two test files (providers/multimodal.rs, runtime/agent/dispatcher.rs) assert generic image-marker canonicalization using image_gen as the fixture and will need a replacement rather than deletion.