F267: Channel-level single identity binding (mechanism layer)

[kaverjody]

What

This PR introduces the mechanism layer (Phase 1) of F267: per-(connector, chat) channel identity override, enforced at the OutboundDeliveryHook adapter edge.

For every cat that posts to an external IM channel (feishu / dingtalk / wechat / telegram groups) which contains non-roster members, the natural display name (砚砚 / 小狸 / 宪宪 / 小捷 / 金哥 / 烁烁) is replaced at the adapter edge with the channel-configured identity. Default for feishu groups is 咖啡猫 🐱; DMs explicitly opt out (KD-2) so the home-environment multi-cat authoring experience is preserved.

Why

External collaborators only ever opted in to a single identity. They cannot tell 砚砚 from 宪宪, and 60% of every message in a busy group is signature noise. This blocks real collaboration with openclaw / hermes / humans who do not share the cat-cafe context. Layer B (prompt pin) and Layer C (audit dashboard) are scoped for follow-up PRs — this PR is the harness-level floor that makes Layer A work without trusting the model.

Files

docs/README.md                                                 | +1
docs/features/F267-channel-single-identity.md                  | new (spec)
docs/references/im-channel-public-contract.md                  | new (public contract)
packages/api/src/infrastructure/connectors/channel-identity.ts | new (registry)
packages/api/src/infrastructure/connectors/OutboundDeliveryHook.ts | +~80
packages/api/test/channel-identity-override.test.js            | new (9 cases)
packages/api/test/outbound-identity-override.test.js           | new (5 cases)

7 files changed. 5 new, 2 modified.

Acceptance Criteria covered

• AC-1A: OutboundDeliveryHook.executeDelivery 增加 channelIdentityOverride 解析 → resolveBindingIdentity 纯函数解析
• AC-1B: 当 binding 配 displayName='咖啡猫' → 出站 envelope 强制为 【咖啡猫🐱】，即使 cat agent 输出 【砚砚🐱】
• AC-1C: 当 binding 没配 override → 旧行为（透传 cat 自带 displayName），overridden: false
• AC-1D: 默认配置 feishu 群（chatType='group'）→ fallback displayName='咖啡猫'；飞书 DM 不走 override
• AC-1E: IM Hub 飞书群面板加「对外显名」开关（follow-up，UI 改动单独 PR）
• AC-1F: 现有 F134 / F157 / F252 行为不变（只在 catDisplayName 推导前多一步 resolve）
• AC-1G: 单元测试：channel-identity-override.test.js 9 cases + outbound-identity-override.test.js 5 cases

Test plan

1. cd packages/api && pnpm install && pnpm build — 编译通过（channel-identity.ts + OutboundDeliveryHook.ts 强类型契约）
2. node --test packages/api/test/channel-identity-override.test.js — 9 cases 全绿
3. node --test packages/api/test/outbound-identity-override.test.js — 5 cases 全绿
4. 集成验证：在 IM Hub 飞书群发 1 条触发消息 → 群成员看到 【咖啡猫🐱】 前缀，不看到 【砚砚🐱】/【小狸🐱】 等
5. 回归：DM 内 cat 自带 displayName 仍正常（KD-2 验证）
6. 回归：cat-cafe 家内 thread 不走 connector，无 override（unaffected）

Out of scope (follow-up PRs)

• Phase 2 — SystemPromptBuilder 注入 ChannelIdentityPin 到 cat prompt（Layer B 治本）
• Phase 3 — IM Hub audit dashboard 监控非预期 displayName（observability）
• P1 — FeishuAdapter 群入站 gate、fingerprint loopback 熔断、OutboundSanitizationLayer（issue Channel-level single identity binding for IM connectors (feishu/dingtalk/wechat/telegram groups) #1195 内 Fix 1/3/4）

Key Decisions

KD	决策	理由
KD-1	双层机制（connector 强制 + prompt pin）	F167 已证 prompt 层天花板（opus-47 仍句中 @ 复现），需要 harness 兜底
KD-2	DM 保留 cat 自带 displayName	用户对 DM 有「一对一 cat」期望，群才暴露
KD-5	exposeInternalNames: false 默认	内部 cat 名泄漏是协作障碍根因
KD-6	cat agent body 仍允许引用「砚砚」做内部提及	不强制改 body 内容，只改 adapter 出口

Risk

风险	缓解
用户看「咖啡猫」但实际是「砚砚」在干活 → 困惑	Phase 2 prompt identity pin + IM Hub audit 段显示当前 cat ID
DM 行为改变	DM 不走 override（AC-1D）
跨 connector 不一致（飞书=咖啡猫，Telegram=其他）	默认值 operator 可配（IM Hub 面板）

Closes #1195