Add declarative identity and channel resources

[heimanba]

Summary

Add declarative Identity and message Channel resources, including Qoder Forward API lifecycle support and credential-based DingTalk configuration.

Why

Users should be able to connect a Forward Agent to DingTalk without manually creating or copying Identity and Channel IDs in the Qoder console. The resource model also needs provider capability seams so future providers can opt into Identity and Channel support independently.

Type

• New provider
• New feature
• Bug fix
• Refactor
• Documentation
• Tests

Surface area

• Workspace/package boundaries
• Provider interface / adapter contract
• YAML schema / config types
• CLI commands
• WebUI
• State management
• Execution / planning logic
• Tests / fixtures
• None of the above

Checklist

• bun run verify:push passes
• New provider follows the six-file structure, if applicable (not applicable; no provider added)
• No new runtime dependencies added without justification

Behavior / risk

The YAML schema now accepts top-level identities and channels, plus defaults.identity. Managed identities are created and owned by OpenAgentPack; declarations containing identity_id remain external references and are never mutated or deleted. Channels resolve logical Agent and Identity names through state before provider calls. Forward sessions require either an explicit --identity-id or a resolvable defaults.identity; there is no hidden provider-default Identity. Providers without Identity or Channel capabilities reject those declarations during validation. Credentials participate in desired-state hashing but are not persisted in state snapshots.

This expands the public resource enum with identity and channel; the committed OpenAPI snapshot and generated WebUI wire types are updated accordingly. Existing configurations without these resources retain their previous behavior.

Validation

• bun run verify:push — all workspace typechecks, architecture checks, tests, and changed-file lint passed.
• SDK suite: 549 tests passed.
• Server suite: 60 tests passed, including OpenAPI snapshot parity.
• Live Qoder smoke test: applied a managed Identity and credential-based DingTalk Channel, confirmed binding_status: bound, confirmed a second plan was a no-op, and ran a Forward Session that returned the expected response.
• Verified DingTalk client_id and client_secret values were absent from the generated state file.