Make Feishu group listening, contact lookup, and replies reliable

[Y1fe1Zh0u]

What changed

• Accept ordinary messages from Feishu groups while preserving provider sender identity and the external-group Session contract.
• Suppress only exact NO_REPLY completions before external delivery.
• Keep normal replies bound to the originating Session and require explicit confirmation for cross-Session sends.
• Keep external-group conversations visible without treating their placeholder user_id as Direct-session ownership.
• Add a provider-native GLANCE acknowledgement only after a completed reply passes NO_REPLY suppression.
• Search the configured Feishu app's live Contact v3 scope when the tenant Directory has no matching person; calendar attendee resolution privately reuses exact-name open_id matches.
• Prevent public external-group Runs from entering waiting_user; clarification is returned publicly and the shared Session lane is released for the next message.

Why

Feishu group Agents need to listen passively without noisy replies, acknowledge only messages they deliberately answer, resolve colleagues from the Bot-visible Feishu directory, and avoid letting one participant's clarification wait block the shared public lane.

Two production failures exposed missing cross-contract coverage:

1. feishu_user_search projected only pre-synced Clawith OrgMember rows, so correctly configured Bot credentials could create calendar events while valid Feishu colleagues still returned zero matches.
2. An external-group Run could enter waiting_user, but channel resume validation expected a Direct/Web Chat thread shape. The Run held external_group_thread:* indefinitely and blocked later messages.

Delivery and safety behavior

• Exact NO_REPLY, Direct Chat, and non-terminal deliveries do not add the reaction.
• Reaction failures are cosmetic and cannot block or duplicate durable text delivery.
• Synced Directory contacts remain authoritative; live Feishu fallback is bounded by the configured Bot's directly granted users and visible departments.
• Provider open_id values remain private to calendar execution and are not exposed in model-visible search results.
• External Feishu groups remain session_type=group, group_id=NULL, and do not gain native Clawith Group handoff tools.
• Public group clarification completes the current Run; only Direct Chat retains waiting_user semantics.
• Existing Feishu apps must approve im:message.group_msg and im:message.reactions:write_only, then publish a new app version.

Validation

• Final clean PR head: 148 scoped Backend tests passed across Feishu Contact search, typed Feishu outcomes, Runtime model steps, Chat intake, Channel intake, and Feishu channel Runtime.
• Scoped Ruff passed for the modified Runtime, Contact-search, and test files.
• git diff --check passed.
• Frontend: 112 tests passed and production build passed for the visibility/reaction commits.
• Live 3010 E2E passed after narrow deployment:
  • a new external-group Session was created without old checkpoint state;
  • Contact v3 queried directly visible users, departments, and department members;
  • calendar event clawith场景讨论 was created for 15:00-16:00;
  • 周逸飞、覃睿、曾征、张健 were all resolved and four invitations were confirmed;
  • the Run completed, released its lane, and delivered the final reply to the originating Feishu group.

Not tested

• Full Backend test suite on the final five-commit PR head.
• Multi-worker load and high-volume concurrent external-group traffic.
• Live rendering of the GLANCE reaction after the new permission is approved.