refactor: read agent._image_rejecting_models directly

init_agent seeds `_image_rejecting_models = set()` at the same site as
`_force_ascii_payload`, which the adjacent sanitize_outbound_kwargs already
reads as a plain attribute. The getattr/isinstance guards and the lazy
re-create in recover_before_classification implied the attribute could be
missing or mistyped on a real agent; it cannot, and defensive fallbacks for
impossible states hide wiring bugs instead of surfacing them. Every test
fixture that reaches these paths seeds the attribute already.

agent/message_sanitization.py

@@ -422,8 +422,7 @@ def strip_images_for_rejecting_model(agent: Any, api_messages: Any) -> bool:
     past it. History is never touched. Keyed on each rejecting (provider, model), so a model
     that accepts images gets them again.
     """
-    rejected = getattr(agent, "_image_rejecting_models", None)
-    if not isinstance(rejected, set) or _provider_model_key(agent) not in rejected:
+    if _provider_model_key(agent) not in agent._image_rejecting_models:
         return False
     return isinstance(api_messages, list) and _strip_images_from_messages(api_messages)
 

agent/turn_recovery.py

@@ -248,9 +248,7 @@ def recover_before_classification(
     # Guarded PER MODEL, not by a turn-global flag: in a fallback chain the next model can reject
     # images too, and a turn-wide flag would skip its recovery and fail the turn.
     _model_key = _provider_model_key(agent)
-    _rejected = getattr(agent, "_image_rejecting_models", None)
-    if not isinstance(_rejected, set):
-        _rejected = agent._image_rejecting_models = set()
+    _rejected = agent._image_rejecting_models
     if _model_key not in _rejected and _looks_like_image_content_rejection(_err_body) and _status_ok:
         # Send-path only. A rejection says what THIS model accepts, not what the conversation
         # holds: stripping ``messages`` (canonical history) and forcing a flush deleted every