Create a machine image from an instance, snapshot, or import URL

Creates a new private machine image in the active scope from one of the two sources with a wired provider path: capture of an existing instance (the instance is briefly quiesced during capture), or an existing volume snapshot (Cinder os-volume_upload_image). The caller supplies name, description, operating system, architecture and an optional AES-256 encryption flag; on acceptance the image becomes discoverable in the scoped list in its transitional PENDING state. Validation: name is required, must match ^[a-z0-9][a-z0-9.-]{1,61}[a-z0-9]$ (3–63 chars, lowercase letters, digits, dots, hyphens) and be unique in the scope — violations map to 422 VALIDATION_ERROR, a duplicate name to 409 CONFLICT; sourceKind is required and the matching source field must be present (sourceInstanceId for instance, sourceSnapshotId for snapshot) else 422; a referenced instance that does not exist or is not accessible in the scope maps to 404 NOT_FOUND, an unknown / out-of-scope sourceSnapshotId to 422 VALIDATION_FAILED; image-storage quota exhaustion maps to 409 QUOTA_EXCEEDED. Async & state: Asynchronous (202). The image is returned immediately in PENDING state and transitions to terminal AVAILABLE on successful build/import or ERROR on failure; each transition is emitted as a resource.updated SSE frame with a patch on status (and sizeGb/updatedAt once the build completes) for the image resource. Errors: 401 unauthenticated; 403 caller lacks contributor/admin/owner on the scope; 404 unknown source instance/snapshot; 409 CONFLICT on duplicate name; 409 QUOTA_EXCEEDED when the image quota is exhausted; 422 invalid body; 500 internal failure. Idempotency/Concurrency: Idempotency-Key is required; replaying the same key returns the originally created image (same id, current state) without provisioning a duplicate.