test(scenario): cover multi-image page generation end to end

The read_image poisoning fix had no end-to-end guard because scenarios could
only send text. Add an upload_images step that renders and uploads visually
distinct images, let chat steps attach them the same way the WeChat channel
does, and assert the generated page actually embeds every upload.

Co-authored-by: Cursor <cursoragent@cursor.com>

.cursor/skills/memind-scenario-test/SKILL.md

@@ -67,12 +67,20 @@ node scripts/run-scenario-test.mjs --scenario suzhou-page
 |--------|------|
 | `login` | HTTP 登录，取 cookie + userId |
 | `chat` | 发消息（同 session 多轮），等 run 终态 + assistant 新回复 |
+| `upload_images` | 生成并上传测试图片到 MindSpace，供后续 `chat` 步骤引用 |
+
+`upload_images` 字段：`categoryCode`（默认 `oa`）、`images[]`
+（每项 `filename` / `background` / `shape` / `accent`，shape 支持
+`circle` `square` `triangle` `diamond`）。后续 `chat` 步骤设
+`useUploadedAssets: true` 即可把这些图作为本轮附件发出。
 
 `chat.expect` 可选断言：
 
 - `assistantMinChars` / `timeoutMs`
 - `replyKeywords`：回复文本关键词
+- `forbidReplyPatterns`：回复中不允许出现的字符串
 - `page.keywords` / `requirePublicLink` / `requireHttp200` / `requireMindspaceCover`
+- `page.requireUploadedImages` / `page.minUploadedImages`：页面必须嵌入 `upload_images` 上传的资产
 
 新增更复杂步骤（截图、微信、多账户）时：先扩展 `scripts/scenario-test-lib.mjs`，再加场景 JSON，**不要**在 skill 里写死一次性命令。