feat(feishu): add process-runnable stdio runtime

[zts212653]

Summary

• release @clowder-ai/feishu-meeting-intake@0.1.0-alpha.1 as a process-runnable package with runtime.transport: "stdio" and dist/entrypoint.js
• consume the two generated-artifact Lark event streams (minutes.minute.generated_v1 and vc.note.generated_v1) through an exact @larksuite/cli@1.0.85 dependency
• perform the contract beta.9 broker.hello / broker.ready handshake before starting either event source, and publish only declared events.publish calls
• persist plugin-owned cursor/outbox state under a Host-instance-derived digest, close partial event-source startup, and terminate process authority when Host grants change
• extend fresh-consumer coverage to prove the packed manifest, immutable version, runtime entrypoint, and exact public dependencies install together

Authority and privacy boundary

• Host supplies only the four non-secret handshake claims; the plugin never accepts a caller-selected executable path, destination, transcript, grant, or credential over the wire
• the nested Lark CLI receives only the OS-derived HOME needed to reuse the existing user-scoped login; PATH, npm/Redis/Cat Café secrets, and Host runtime state are not forwarded
• stdout/stdin remain canonical NDJSON protocol channels and stderr remains diagnostics-only
• signal payloads contain bounded meeting metadata plus an opaque source handle; transcript resolution and all destination decisions remain Host-owned
• this PR makes the public artifact runnable but does not activate automatic startup or real-meeting dogfood in Cat Café

Risk snapshot

• Behavior: high — adds a long-lived executable event source and beta.9 handshake lifecycle; covered by process/runtime tests and independent exact-HEAD review.
• Data: medium — persists cursor/outbox/idempotency state under a hashed Host instance identity; no transcript or destination is stored or emitted.
• Security: high — child-process environment, NDJSON framing, grant loss, and authority shutdown are fail-closed and tested.
• Contract: high — changes the public manifest from builtin to stdio, adds an immutable entrypoint and exact runtime dependency, and remains conformant to beta.9.
• Irreversible: high — merging triggers the authorized immutable npm prerelease 0.1.0-alpha.1; registry integrity is verified after publication.

Verification

• pnpm build
• pnpm typecheck
• pnpm lint
• pnpm test (Feishu package 19/19; workspace green)
• pnpm conformance (32/32 fixtures + 18/18 behavior cases)
• pnpm --filter @clowder-ai/plugin-contract generate:check
• pnpm test:fresh-consumer
• npm pack --dry-run --json confirms dist/entrypoint.js, manifest, schema, and no source/test files
• exact package runner: lark-cli version 1.0.85 under an environment containing only HOME

Refs #23

[zts212653]

Exact-HEAD review — verdict: APPROVE

Reviewed commit: f917994e93fc2a3dad1cbe51f682ebf567f47a09
Reviewer: Kimi (k3)

Six attack surfaces, all verified at code level:

1. Manifest/package truth — alpha.1, runtime.transport: "stdio", entrypoint: dist/entrypoint.js; independently packed: tarball contains dist/entrypoint.js and manifest/package versions agree (fresh-consumer test pins both plus the exact @larksuite/cli@1.0.85 dep). ✓
2. Handshake authority — broker.hello → acceptSessionBinding (phase must be bound) → broker.ready (null result) → prepareActivation (phase must be activated); gateway/runtime/publisher are created strictly after activation (pre-ready zero source); the outbound call union is exactly broker.hello | broker.ready | events.publish; every inbound frame passes the beta.9 classifyFrame (close → fatal); host.grants.changed with changed revision/grants or missing events.publish terminates the process. The 180-line stdio test locks all of this, including reserved-row zero dispatch. ✓
3. lark-cli children — spawned argv-only via process.execPath on the bundled entrypoint (shell: false), env is exactly { HOME } (no PATH/NPM_TOKEN leakage — test asserts the four-claim extraction ignores them); events on stdout with 256KB/line + invalid-JSON fail, diagnostics on stderr bounded to 32KB; readiness gate before consumption; partial-start closes opened consumers; close() ends stdin with a 2s SIGTERM fallback. ✓
4. Bounded metadata only — the normalizer uses closed key sets per event type and produces only {artifactId, kind, revision, generatedAt, title≤512, meetingId?}; no transcript path exists in the event process (inspectArtifact default honestly throws UNAVAILABLE — transcript resolution stays Host-side). No destination/cat/thread addressing anywhere. ✓
5. Durable state + reconnect honesty — state path derives from sha256(pluginInstanceId) under ~/.clowder-ai/plugin-state/ (Host identifier never used as a path — test covers a ../ instance id); consumer drop fails the process loud instead of pretending to reconnect; cursor/idempotency truth stays with the pre-existing reviewed runtime/state-store plus Host-side sourceIdentity. ✓
6. Release continuity — fresh-consumer install proves the packed artifact installs with exact public deps; version/immutability and toolchain pins unchanged; no workspace protocol in publishable deps. ✓

Independent gate evidence (clean worktree, Node 24.16, exact f917994e): typecheck/lint/build exit 0 (explicitly code-checked); contract 309/309, SDK 218/218, stackchan 44/44, Feishu 19/19, loopback 61/61; conformance 32/32 + 18/18; fresh-consumer 1/1; generate:check current; git diff --check PASS. GitHub CI green.

APPROVE for merge at exact HEAD f917994e93fc2a3dad1cbe51f682ebf567f47a09. Note this merge publishes feishu-meeting-intake@0.1.0-alpha.1; under the CVO-approved restored semantics it will sit on latest until a stable supersedes it.

[墨墨/Kimi-k3🐾]