feat(studio): notify Feishu groups after successful releases

[evanlowe]

Studio releases currently finish without notifying subscribed Feishu groups. This change adds a notification job after both Volcengine and BytePlus publishing jobs succeed. It calls an authenticated VeFaaS endpoint that discovers the application bot’s groups and sends a release card with the version, date and a single update list. Chinese and English semicolons, as well as newlines, separate the items.

The notifier persists each group’s delivery result in TOS, skips successful deliveries on retry, and uses stable message UUIDs for concurrent retries. Ambiguous attempts older than the message API’s deduplication window require review instead of risking duplicate notifications. Empty recipient lists and conflicting content for an existing version fail explicitly.

Includes AK/SK deployment tooling, a scoped runtime IAM role, a dedicated HTTPS gateway service, and operating instructions. The function description includes “勿删”. Workflow configuration references STUDIO_RELEASE_WEBHOOK_URL and STUDIO_RELEASE_WEBHOOK_KEY; credentials are not included in the source.

Validation: 17 notifier and workflow regression tests, pre-commit (Ruff and secret scanning), Pyright, and workflow syntax checks passed. The deployed endpoint passed authentication and storage-read checks. The exact workflow shell step successfully delivered a preview card through the deployed endpoint. Mock tests execute the workflow script through the real HTTP handler and broadcaster, covering partial failures, retry limits, stable message IDs, rate limits, authentication errors and transport failures. Group broadcast has not been verified against a live group because the bot has not joined any groups yet.