List and query machine images in the active scope

Returns the machine images (public marketplace images and private, org-authored golden images) visible in the active tenant/subscription/project scope, as rendered by the the Images page table. This single collection endpoint serves BOTH the plain route-load list and the search/filter/sort/pagination controls: free-text q matches image name and OS, the UI's quick-filter chips map to the visibility (Public/Private) and arch (arm64) query parameters, and the table sorts on name, sizeGb and createdAt via sort+order. No resource state is mutated by this call. Validation: scopeId must resolve to an accessible scope or the request fails with 403 FORBIDDEN; unknown sort fields, non-enum visibility/arch/status/os values or out-of-range page/pageSize map to 422 VALIDATION_ERROR. Soft-deleted images are always excluded (deleted_at IS NULL). Async & state: Synchronous read; no state change. Returns a stable snapshot suitable for the table; live status transitions arrive over the realtime channel as resource.updated frames keyed by image id. Errors: 401 when the session is missing/expired; 403 when the caller lacks reader access to the scope; 422 on malformed query parameters; 500 on backend read-model failure. Idempotency/Concurrency: Safe, cacheable; no idempotency key required. Pagination is cursor-stable per meta so repeated reads with identical parameters return consistent pages.