feat(wecom): migrate WeCom trust config to first-class [wecom] section (Phase 1)

[chaodu-agent]

Summary

Migrate WeCom adapter trust configuration from gateway env vars to a first-class [wecom] section in config.toml.

Current State

• Gateway env vars only (GATEWAY_ALLOW_ALL_USERS, GATEWAY_ALLOWED_USERS)
• No per-platform granularity for WeCom

Target State

[wecom]
allowed_users = ["zhangsan", "lisi"]
trusted_bot_ids = ["bot_app_1"]
# allow_all_users = true  # explicit opt-in only

Tasks

• Add [wecom] section to config schema
• Wire WeCom trust through PlatformTrustConfigs registry
• trusted_bot_ids for is_bot derivation (no enter_agent — that is user-initiated)
• Deprecate gateway env vars for WeCom
• Update docs and config.toml.example

Notes

• WeCom UserIDs are freeform strings (tenant-admin-assigned: letters, digits, -, _, @, .)
• enter_agent (member-enter event) is user-initiated — must NOT be classified as is_bot
• WeCom UserIDs could match reserved synthetic values — this is why cron bypass only checks platform, not sender_id

Refs

• Umbrella: umbrella: Phase 1 trust migration — per-platform [section] for all adapters #1356
• ADR: docs(adr): revise identity-trust-none — three-layer architecture #1291

[github-actions]

⚠️ This issue is missing the following required information and will not be processed until completed:

• Use Case

Please edit this issue to fill in the missing fields. Thank you!

Tip: Use headings like ## Description or ### Description — common synonyms (e.g. ## Problem, ## Reproduction, ## Motivation) are also accepted.