refactor(knowledge): remove sandbox dependency for DingTalk document upload

[parabala]

Summary

Remove sandbox exec dependency for DingTalk document upload by introducing dedicated MCP tools.

Changes

New MCP Tools (app/mcp_server/tools/dingtalk_upload.py)

1. dingtalk_upload_file_from_url - Downloads file from URL and uploads to Wegent

   • Downloads file from DingTalk download_url
   • Uses secure temporary file handling
   • Automatically cleans up temp files after upload
   • Returns attachment_id for use with wegent_kb_create_document

2. dingtalk_upload_content - Saves content to file and uploads to Wegent

   • Writes content (e.g., markdown) to temporary file
   • Supports configurable text encoding
   • Automatically cleans up temp files after upload
   • Returns attachment_id for use with wegent_kb_create_document

Updated Files

• app/mcp_server/server.py: Import dingtalk_upload module for tool registration
• app/mcp_server/tools/init.py: Export DINGTALK_UPLOAD_MCP_TOOLS
• init_data/skills/wegent-knowledge/SKILL.md:
  • Remove all sandbox exec references
  • Document new helper tools
  • Update workflow steps and examples

Why

Previously, uploading DingTalk documents required using sandbox exec commands with curl, which:

• Required shell access in the execution environment
• Was error-prone with manual command construction
• Made error handling difficult

The new approach:

• Uses native Python HTTP requests
• Provides proper error handling and logging
• Handles temporary file cleanup automatically
• Integrates seamlessly with existing attachment service

Test Plan

• Test dingtalk_upload_file_from_url with file-based documents
• Test dingtalk_upload_content with markdown content
• Verify temporary files are cleaned up after upload
• Verify attachment_id is returned correctly
• Test error handling for invalid URLs
• Test error handling for encoding issues