feat(doc): 增加文档评论会话安全入口

[leohxj]

What changed

• Add doc comment session configuration under docComments, including explicit document allowlists, per-document author allowlists, and optional pinned working directories.
• Add doc session policy helpers for stable document anchors, filesystem-safe temporary workspaces, and talk-only collaborator access.
• Harden working directory root checks against sibling-prefix and symlink escape cases.
• Document the new config in README, README.en, and bots.json.example.

Why

Document comments can bring arbitrary collaborators into a bot-visible surface. The first PR establishes the permission and workspace boundary before wiring the live Feishu comment event loop.

Validation

• pnpm exec vitest run test/working-dir.test.ts test/doc-comment-session.test.ts test/bot-registry.test.ts test/setup-verify-permissions.test.ts passed: 68 tests.
• pnpm build passed.
• pnpm test was attempted and still has existing environment-dependent failures: Feishu browser e2e missing FEISHU_TEST_GROUP_URL / MIDSCENE_MODEL_NAME / MIDSCENE_MODEL_API_KEY, CLI/tmux e2e posix_spawnp failed, and an existing bridge-final-output-retry mock missing resolveBrandLabel.

[deepcoldy]

好主意啊👍

@leohxj 要等你把完整功能实现了再Merge么

[leohxj]

@deepcoldy 哈哈，缺一个 qa agent.
我看看怎么测试一下效果，能用了，找你讨论下合并。

[Hellovolcanoone]

@leohxj 这个feat，做完了吗