docs(providers): record verified OCI Generative AI capabilities

Document the OpenAI-compatible operations exercised through the sandbox
proxy with the oci-genai profile: chat completions with streaming, tool
calling, vision input including a large request body, embeddings,
Responses with streaming, and the GET/DELETE rule coverage. Add the two OCI
error messages operators are most likely to hit and what they mean.

Signed-off-by: Federico Kamelhar <federico.kamelhar@oracle.com>

Author: fede-kamel

docs/how-it-works/providers/oracle.mdx

@@ -146,6 +146,25 @@ The profile ships `curl` as its only client binary. Add your interpreter or
 agent CLI to `binaries` in a copy of the profile before importing it, or the
 credential is never injected for that process.
 
+## Verified Capabilities
+
+The following OpenAI-compatible operations were exercised through the sandbox
+proxy with this profile against `us-chicago-1`. All of them pass with the
+credential injected by the proxy and none of them required changes to the
+profile.
+
+| Operation | Result |
+|---|---|
+| `POST /openai/v1/chat/completions` | Works, including `stream: true` server-sent events. |
+| Tool calling (`tools`, `tool_choice`) | Works; the response carries `tool_calls` and `finish_reason: tool_calls`. |
+| Vision input (`image_url` with a `data:` URL) | Works on multimodal models such as `meta.llama-4-maverick-17b-128e-instruct-fp8` and `google.gemini-2.5-flash`. A 263 KB request body passed the L7 proxy unchanged. |
+| `POST /openai/v1/embeddings` | Works with `openai.text-embedding-3-small`. Cohere embedding models return `400 Unsupported OpenAI operation` on this endpoint; call them through the native API instead. |
+| `POST /openai/v1/responses` | Works, including `stream: true`. Stored responses (`store: true`) need an OCI conversation store; see the OCI documentation for the `opc-conversation-store-id` header. |
+| `GET` and `DELETE` under `/openai/v1` | Allowed by the profile rules for Responses lifecycle calls. Any other method, such as `PUT`, is denied by the proxy with `403 policy_denied`. |
+
+Models not exposed on the OpenAI-compatible endpoint return
+`404 Entity with key <model> not found` from OCI, not from the proxy.
+
 ## Regions and Realms
 
 The profile's host pattern `inference.generativeai.*.oci.oraclecloud.com`
@@ -186,6 +205,12 @@ covers them as well.
 - **`GET /openai/v1/models` returns `404`.** Model listing is not served on
   this endpoint. Do not use it as a health check; send a small chat request
   instead.
+- **`404 Entity with key <model> not found`.** The model is not served on the
+  OpenAI-compatible endpoint, or the identifier is wrong. Use the OCI model
+  identifier form, for example `meta.llama-4-maverick-17b-128e-instruct-fp8`.
+- **`400 Unsupported OpenAI operation`.** The model family does not support
+  that operation on this endpoint, for example Cohere embeddings. Use the
+  native API for those models.
 - **Request denied by the sandbox proxy.** Check that the calling binary is in
   the profile's `binaries` list and that the request path starts with
   `/openai/v1`. Use `openshell sandbox logs` to see the denial.