fix: three new oxlint findings from main

design/src/provider.ts:121 uses startsWith instead of a caret regex (same
result; RegExp#test also coerced with String). design/test/gemini-provider.test.ts:47
spreads init?.headers directly (spreading undefined is a no-op).
test/hook-scripts.test.ts:1726 drops the unused base binding. Baseline unchanged at 970.

Co-authored-by: capy-ai[bot] <230910855+capy-ai[bot]@users.noreply.github.com>

design/src/provider.ts

@@ -118,7 +118,7 @@ export function readImage(auth: DesignAuth, data: any): { responseId: string; im
   const parts: any[] = candidate?.content?.parts ?? [];
   const images = parts.filter(part => {
     const inline = part?.inlineData ?? part?.inline_data;
-    return typeof inline?.data === "string" && /^image\//.test(inline.mimeType ?? inline.mime_type ?? "");
+    return typeof inline?.data === "string" && String(inline.mimeType ?? inline.mime_type ?? "").startsWith("image/");
   });
   const image = images.findLast(part => part?.thought !== true) ?? images.at(-1);
   if (image) {

design/test/gemini-provider.test.ts

@@ -44,7 +44,7 @@ const savedConsoleLog = console.log;
 function stubFetch(reply: (url: string, n: number) => Response) {
   globalThis.fetch = (async (input: any, init?: any) => {
     const url = String(input);
-    calls.push({ url, headers: { ...(init?.headers ?? {}) }, body: JSON.parse(String(init?.body)) });
+    calls.push({ url, headers: { ...init?.headers }, body: JSON.parse(String(init?.body)) });
     return reply(url, calls.length);
   }) as typeof globalThis.fetch;
 }

test/hook-scripts.test.ts

@@ -1723,7 +1723,7 @@ describe('check-freeze.sh', () => {
     // The host resolves a relative path against its physical cwd; a logical
     // $PWD through a symlink names a different parent for '..'.
     test.skipIf(process.platform === 'win32')('a relative path resolves against the physical working directory', () => {
-      withTree(({ base, home, src, outside }) => {
+      withTree(({ home, src, outside }) => {
         const work = path.join(outside, 'work');
         fs.mkdirSync(work);
         fs.mkdirSync(path.join(src, 'a', 'b'), { recursive: true });