feat(contract): add C-2 signal ingress and Feishu meeting intake

[zts212653]

Summary

This is F292 PR 1/3. It lands the public C-2 signal-ingress contract and the official Feishu meeting-intake adapter in the plugin repository from day one.

• add declared input-source / signals.provides[] manifest schema and the bounded events.publish wire row;
• generate matching public types, SDK publication helpers, byte-bound proofs, and conformance fixtures;
• add the official Feishu meeting-artifact package with durable cursor/outbox ordering, redelivery deduplication, typed health, and manual import;
• keep transcript bytes, credentials, source-grant verification, durable Host intake, and all cat/thread/channel routing outside the plugin boundary;
• prove all packed public packages install and import in a fresh npm consumer.

Part of #23.

Convergence

The feature remains three reviewable PRs, without splitting contract and its first real consumer apart:

1. This PR: public C-2 contract + SDK + official Feishu adapter.
2. Host PR: K-3a admission, source-grant verification, durable MeetingIntake, and repair/health truth.
3. Experience PR: Needs Me projection, private-thread journey, real meeting dogfood, and release evidence.

This PR deliberately does not claim Host routing, Needs Me, F290 Channel delivery, transcript summarization, or Feishu writeback.

Boundary and failure model

• Publications are accepted only for an installed declaration and its resolved payload schema.
• Feishu publications require a canonical source handle that agrees with bounded metadata; transcript-shaped/open payloads and destination fields are rejected.
• Polling cannot resolve transcripts. Transcript resolution is a separate Host-only gateway call carrying intakeId plus an opaque sourceGrant.
• Plugin cursor advancement occurs only after the page is durably enqueued; publication is acknowledged only after Host acceptance, so restart/redelivery remains recoverable.
• Canonical source handles use raw-byte equality, preventing URL aliases from weakening grant identity.
• Request/result/error wire maxima and their N+1 leaves are executable proofs, including all permitted standard-error envelopes.

Review continuity

Terra independently APPROVED the pre-rebase exact head fa1073701ec256fc7786d7868df2c86d1ecde6d4 with 0 P1 / 0 P2 after two Red→Green review rounds.

The prerequisite #22 was squash-merged as c6c59fa7c98b9c243fc264b7f1757cbdf6b210d4. This branch was then rebased onto that exact origin/main. Continuity evidence:

• old reviewed commits 5dd5e5d, 5a8a31c, fa10737 map to c91d5e8, 91ba0ad, 9e5bf74;
• all three stable patch IDs are unchanged;
• git range-diff reports all three commits as =;
• the only base overlap is SDK wire dispatch, and the post-rebase full test/gate suite passes.

Risk axes: behavior high; data/security high; public contract high; irreversible low until merge.

Verification

• pnpm typecheck
• pnpm test
• pnpm lint
• pnpm build
• pnpm conformance — 32/32 contract fixtures + 18/18 behavior cases
• pnpm test:fresh-consumer
• pnpm --filter @clowder-ai/plugin-contract generate:check
• git diff --check
• clean worktree; no secret-like files or added TypeScript any

[zts212653]

Local exact-HEAD review — APPROVE

Mechanical transcription by the author of Terra's persisted Cat Café verdict; no reviewer judgment was rewritten.

• Reviewed HEAD: 9e5bf745f5ece3b393e373d343d35a94feba7477
• Verdict: APPROVE — 0 P1 / 0 P2
• Durable verdict anchor: thread thread_msl95rhgrjiphdp1, message 0001786264215030-001229-e755775d
• Original reviewed head/base: fa1073701ec256fc7786d7868df2c86d1ecde6d4 / e34a85b3078f450e2fa863f5d32b36ceecaca96b
• Current base: c6c59fa7c98b9c243fc264b7f1757cbdf6b210d4

Continuity evidence:

• C1: all three authored commits have unchanged stable patch IDs; range-diff reports each as =.
• C2: the only base overlap is SDK wire dispatch and its test. Terra independently inspected the combined H7 handshake and row-13 signal semantics: method ownership, request/response precedence, authority rejection, valid publication, receipt/error settlement, and same-type audit all remain intact.
• C3: typecheck, SDK 218/218, workspace tests, lint, build, conformance 32/32 + 18/18, fresh-consumer install, contract generation check, git diff --check, and GitHub CI all pass on the current head.

This comment records the independent logical review provenance required by the merge gate. It is not represented as a GitHub-native approval from a different GitHub account.