fix: resolve current VRChat icons with file provenance

[BASIC-BIT]

[AGENT] Current VRChat user responses can return iconUrl without userIcon, so the collector resolves a person's name but drops their automatic picture. Accept the current response only after a budgeted exact-file lookup confirms its identity, owner, icon purpose, and complete referenced version. Preserve explicit legacy icons and the existing artwork result contract.

The regression reproduces the observed response through the real HTTP client and collector job. Coverage rejects avatar-purpose, foreign, incomplete, and ambiguous files, and checks the second request's budget, authentication, and rate-limit handling. Updated the behavior and collector docs.

Validation: 182 collector tests, 18 backend destination/fallback/projection tests, 13 artwork/cache tests, backend typecheck, and Markdown lint passed. Independent source review found no actionable defects.

Deployment and cache refresh are separate. Collector-account file visibility and default/migrated icon behavior still need runtime verification before refreshing affected production rows.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	⚠️ Failed 2026-10-15T05:09:03.795706Z	2afc593	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[greptile-apps]

Confidence Score: 5/5

[Medium impact] The PR appears safe to merge: #371.

Summary

Adds automatic pictures for current VRChat iconUrl responses after checking the referenced file’s identity, owner, purpose, and complete version.

• VRChat profile links can use verified current user icons.

Diagram

%%{init: {'theme': 'neutral'}}%%
flowchart TD
  A[Read VRChat user] --> B{Allowed userIcon?}
  B -->|Yes| C[Return legacy icon]
  B -->|No| D{Supported iconUrl reference?}
  D -->|No| E[Return name without artwork]
  D -->|Yes| F[Reserve budget and read file]
  F --> G{Identity, owner, purpose and version match?}
  G -->|Yes| H[Return verified user_icon]
  G -->|No| E
  F -->|Temporary failure| I[Keep cached result]
  F -->|Authentication or rate limit| J[Use existing account handling]

Loading

_{Reviews (1) · Last reviewed commit: "fix: resolve current VRChat icons with f..." · Reviewed by Greptile}

[github-actions]

[AGENT]

Claude Review

Claude review for commit 2afc59306fe9e1c270746c117743f46abede2b28 is unavailable because the pull request was merged.

This is not a current review or approval.

[github-actions]

PR verification report

All configured preview and verification checks passed.

Visuals selected for this run: no (assertions only).

Check	Result	Evidence
Public route smoke	PASSED	Open artifact
Mutation data flow	PASSED	Open artifact
Hosted data flow	PASSED	Open artifact
Public route assertions only	PASSED	Open artifact
Public route image diff	NOT SELECTED	Not requested
Storybook assertions only	PASSED	Open artifact
Storybook image diff	NOT SELECTED	Not requested

Changed visual baselines: none.

Updated from Baseline Checks run 38685227349, attempt 1 for 2afc593. This comment is updated in place.