Delete a machine image

Deletes a machine image the active scope's tenant OWNS, as triggered by the destructive "Delete" action in the Images page row menu and the image detail page header. The backing Glance image is removed from the cloud and the catalog row disappears from every scoped read, so the image stops consuming image quota and storage. Validation: imageId must reference an image visible in the scope (404 NOT_FOUND otherwise). Only a PRIVATE, tenant-owned image is deletable through this tenant route — a PUBLIC / platform / shared catalog image is refused with 403 FORBIDDEN, because it is managed by the platform operator (see the admin catalog surface). An image still PENDING (mid-capture) must finish or fail first (409 DEPENDENCY_BLOCKED); an image already DELETING is refused (409 CONFLICT); an image still in use by one or more live instances is refused with 409 DEPENDENCY_BLOCKED naming the blocking instances. The caller needs destructive-action rights on the scope (403 FORBIDDEN otherwise). Async & state: Asynchronous (202) returning an Operation handle. The image flips to the transitional DELETING status, the worker removes it from Glance (an already-absent provider image is tolerated) and then removes the catalog row; a resource.updated SSE frame patching status is emitted for the image id. On failed the image settles terminally on ERROR (never wedged in DELETING) and stays queryable so the delete can be retried. Errors: 401 unauthenticated; 403 insufficient role or a non-owned/public image; 404 unknown image; 409 DEPENDENCY_BLOCKED when the image is still capturing or in use, 409 CONFLICT when a delete is already in flight; 412 stale If-Match ETag; 500 internal failure. Idempotency/Concurrency: Idempotency-Key is optional (recommended) — replaying the same key returns the original Operation instead of enqueueing a second delete. If-Match with the image's current ETag guards against deleting a concurrently modified image (412 PRECONDITION_FAILED on mismatch).