fix(hub): download Feishu resources via bot-owned lark-cli

Agent tool downloads and trigger attachment staging both used the SDK
messageResource path, which fails closed for multi-MB teacher files and
did not share the bot-identity transport contract. Route every download
through Hub-owned createFeishuBotCli (secret via stdin, disposable HOME,
HUB_FEISHU_CLI_BIN), keep workspace containment on write, and inject the
adapter in trigger tests.

hub/.env.example

@@ -54,6 +54,10 @@ HUB_SKILL_STORE_ROOT="/var/lib/cph-hub/state/skills"
 # This process is pinned to exactly one Organization. Feishu credentials are
 # resolved from that Organization's encrypted ACTIVE connection.
 HUB_SILO_ORGANIZATION_ID=""
+# Absolute path to the bot-only lark-cli binary used by Agent Feishu tools.
+# The CLI is invoked by Hub with a disposable HOME and the ACTIVE Feishu
+# Application Connection; the App Secret is never put in Agent argv/env.
+HUB_FEISHU_CLI_BIN="/usr/local/bin/lark-cli"
 HUB_SYSTEMD_UNIT="cph-hub-example.service"
 
 # Absolute path to the `cph` binary (ADR-0016). Production preflight requires