feat(teams): migrate MS Teams trust config to first-class [teams] section (Phase 1)

[chaodu-agent]

Summary

Migrate MS Teams adapter trust configuration from gateway env vars to a first-class [teams] section in config.toml.

Current State

• Gateway env vars only (GATEWAY_ALLOW_ALL_USERS, GATEWAY_ALLOWED_USERS)
• No per-platform granularity for Teams

Target State

[teams]
allowed_users = ["29:1abc...", "29:2def..."]
trusted_bot_ids = ["28:bot-id"]
# allow_all_users = true  # explicit opt-in only

Tasks

• Add [teams] section to config schema (feat(trust): [wecom]/[googlechat]/[teams] first-class trust sections (Phase 1) #1366)
• Wire Teams trust through PlatformTrustConfigs registry (feat(trust): [wecom]/[googlechat]/[teams] first-class trust sections (Phase 1) #1366 — embedded/unified path)
• is_bot derivation: activity.from.role == "bot" or trusted_bot_ids.contains(activity.from.id)
• Deny-echo via Bot Framework sendToConversation
• Deprecate gateway env vars for Teams (feat(trust): [wecom]/[googlechat]/[teams] first-class trust sections (Phase 1) #1366)
• Update docs and config.toml.example (feat(trust): [wecom]/[googlechat]/[teams] first-class trust sections (Phase 1) #1366)

Notes

• Sender ID format: activity.from.id (e.g., "29:1abc...") — may differ from AAD Object ID
• L1 auth: JWT (OpenID Connect) RS256 verified via Bot Framework OpenID metadata + JWKS
• Verify sender ID format from actual event payloads before finalizing config format

Refs

• Umbrella: umbrella: Phase 1 trust migration — per-platform [section] for all adapters #1356
• ADR: docs(adr): revise identity-trust-none — three-layer architecture #1291

[github-actions]

⚠️ This issue is missing the following required information and will not be processed until completed:

• Use Case

Please edit this issue to fill in the missing fields. Thank you!

Tip: Use headings like ## Description or ### Description — common synonyms (e.g. ## Problem, ## Reproduction, ## Motivation) are also accepted.