#22348: fix(tests): pass localRoots to media test fixtures (#22191)

## Summary Fixes #22191 -- `src/web/media.test.ts` fails on CI with `LocalMediaAccessError` because test fixtures in `/tmp` are blocked by the default allowed-roots policy. ## Problem After recent path-hardening changes to `loadWebMedia`, local file access is restricted to explicitly allowed directories by default. The 7 affected tests write image fixtures to a temp directory but call `loadWebMedia(file, cap)` without passing `localRoots`, so the path guard rejects them: ``` LocalMediaAccessError: Local media path is not under an allowed directory: /tmp/openclaw-media-test-xIlyyu/media-1.png ``` ## Fix Pass `{ localRoots: [fixtureRoot] }` to each of the 7 `loadWebMedia` calls that load from the temp fixture directory. This explicitly allows the test fixture path without weakening production restrictions. **Tests fixed (all in `src/web/media.test.ts`):** - `strips MEDIA: prefix before reading local file` - `compresses large local images under the provided cap` - `optimizes images when options object omits optimizeImages` - `allows callers to disable optimization via options object` - `sniffs mime before extension when loading local files` - `preserves PNG alpha when under the cap` - `falls back to JPEG when PNG alpha cannot fit under cap` ## Verification ```bash npx vitest run src/web/media.test.ts # 24 tests passed (24) ``` The existing `local media root guard` tests (which explicitly test the `localRoots` mechanism) are untouched and continue to pass.