fix(agent): preserve lark-cli credentials with isolated HOME - #234

Summary

• inject LARKSUITE_CLI_DATA_DIR on Linux from the OS account home so an isolated agent HOME does not hide the lark-cli keychain
• resolve lark-cli before agent launch, expose its absolute path, and tell bridge agents to use it when login shells reset PATH
• cover environment construction, prompt contracts, and both process adapters with regression tests

Why

Bridge profiles can isolate HOME for Codex or the daemon while the lark-cli App Secret remains in the service account keychain. lark-cli then searches the isolated home and API calls fail with invalid_client / invalid param.

Separately, non-interactive login shells can replace the inherited PATH, making a valid lark-cli installation fail with command not found. Passing only a modified PATH is therefore insufficient; agents need the resolved absolute executable path.

No App Secret is exposed through the agent environment.

Validation

• pnpm test (99 files, 627 tests)
• pnpm typecheck
• pnpm build
• git diff --check
• manual Linux verification with an isolated HOME: auth status --verify returned verified: true, and im +chat-list --as bot returned ok: true