Add governed Miaoda delivery and audience-aware reports

[huangruiteng]

Summary

• add a typed hosted-delivery request that must resolve an enabled miaoda_html profile sink
• expose loopx periodic-report publish-miaoda with provider-free preview and explicit --execute
• keep the provider command registrar and handler in the Lark extension so the Periodic Report capability never imports Lark provider code
• publish through authenticated lark-cli and require exact app id, online URL, and published-state readback
• add a profile-owned periodic_report_audience_policy_v0 and provider-neutral announcement plan
• mention a symbolic recipient only when an eligible normalized item matches an owned domain or explicit typed routing rule; unrelated recipients are omitted
• let the Lark adapter resolve only selected recipients and reject authored <at> markup, missing identity renderers, or document/artifact drift before send
• keep local HTML usable while preventing it from satisfying a hosted delivery intent
• bump the bundled loopx-lark extension contract to 1.5.0 and document activation, preview, execution, rollback, and audience boundaries

Authority and safety boundary

• no external call, identity lookup, or message send occurs during preview
• execution targets an operator-selected existing app; it does not create an app or mutate audience/access scope
• credentials remain in lark-cli; requests reject credential and private-path fields
• the hosted sink is satisfied only after exact provider readback
• audience relevance uses normalized domains and typed selectors only; titles and summaries never infer recipients
• provider identities remain extension-owned and are resolved only for selected symbolic ids

Validation

• pytest -q tests/architecture/test_control_plane_import_boundaries.py tests/extensions/test_periodic_report_miaoda.py tests/capabilities/test_periodic_report_audience.py tests/capabilities/test_periodic_report_profile.py tests/capabilities/test_periodic_report_adapters.py tests/extensions/test_extension_runtime.py — 117 passed after rebasing onto the concurrent provider-boundary fix
• python3 examples/control_plane/cli-output-budget-regression-smoke.py
• python3 examples/cli-command-module-size-ownership-command-modularization-smoke.py
• python3 examples/periodic-report-smoke.py
• python3 examples/periodic-report-profile-smoke.py
• python3 examples/periodic-report-bindings-smoke.py
• python3 examples/periodic-report-html-smoke.py
• python3 examples/periodic-report-adapters-smoke.py
• python3 examples/lark-extension-activation-smoke.py
• public/private boundary scan: 23 changed-surface files, 0 errors
• DCO sign-off and local pre-push inventory passed

Review decision

Ready for maintainer review. This adds real external-write and recipient-mention paths and is not a self-merge candidate.

[huangruiteng]

Pushed architecture-boundary fix 84c5a48b7e8e6c34ae37357090522a22d7020755 after investigating the failed pytest job.

Root cause: the provider-neutral periodic-report capability directly imported loopx.extensions.lark, violating the extension-ownership contract enforced by test_lark_projection_sinks_are_owned_by_the_extension_layer.

Fix:

• moved Miaoda-specific argument registration and command execution into loopx.extensions.lark.periodic_report_cli
• kept the public loopx periodic-report publish-miaoda command unchanged
• composed the provider command through the top-level CLI while leaving the core periodic-report module provider-neutral
• retained explicit preview/execute separation, extension activation, authenticated lark-cli ownership, and exact readback

Validation:

• 131 related periodic-report, Lark extension, extension runtime, registry/documentation, and architecture-boundary tests passed
• the previously failing architecture test now passes
• risk-based pre-merge gate: 4 direct checks + 17 selected canaries/boundary checks passed; 0 failures, 0 warnings, 0 manual holds
• public/private boundary scan clean across all 12 PR files
• exact-scope change-quality receipt cqr_a7edb5ebc05342db7b1c is valid

Merge decision: keep this PR in independent maintainer review despite the clean automated gate. It introduces a real external-write path, so I am not self-merging it. Fresh GitHub checks are now running on the repaired head.

[huangruiteng]

Exact-head re-review completed for afe1c58142589599fcea6f908811af157502955f.

The follow-up commit adds a typed, provider-neutral audience relevance policy and keeps Lark identity rendering plus all external effects inside the Lark extension. I found no new blocker in the final 17-file scope. The earlier core-to-extension import violation remains fixed.

Validation on this exact head:

• 103 focused periodic-report, audience, Miaoda, profile, adapter, presentation, capability-registry, and architecture-boundary tests passed.
• Isolated mypy passed for the new audience policy, profile integration, and Lark presentation modules.
• loopx canary premerge --from-git-diff --goal-id loopx-meta passed all 17 selected checks: 8 catalog canaries, 8 risk-profile smokes, and the public-boundary scan; no failures, warnings, or manual holds.
• Exact change-quality receipt cqr_9ccde94d2535beb8d043 is valid for fingerprint 9ccde94d2535beb8d043497f1f43bf212eab38722d15143b35b1ed698e154201.
• GitHub DCO, dependency review, both builds, Linux pytest, and Windows PowerShell checks are green.

I am intentionally leaving the PR open for the requested Lark CODEOWNER review. This introduces a real hosted external-write path and audience mention rendering, so it should not use author self-merge even though the automated risk gate is green. @steven-kid is already requested.