feat(report): support delegated sender submission

[pangpangDaddy]

What changed

• add --sender-user-id to dws report entry submit and the deprecated dws report create alias
• route delegated submissions through DingTalk OAPI POST /topapi/report/create using the caller's own application credentials
• preserve the existing MCP report.create_report path when no sender is specified
• reuse the current report content loading, normalization, path-safety, symlink, and size-limit checks
• update schema metadata, parameter bindings, generated catalogs, command guidance, and report skills
• add helper and application tests for routing, field mapping, dry-run credential isolation, and failure handling

Why

PR #408 was closed after the report helper and schema contracts changed, while #406 remained open. This reimplements the requested delegated-sender behavior on top of the current static internal/helpers/report.go flow and current schema/security requirements.

Behavior and safety

• an explicitly empty --sender-user-id is rejected
• delegated OAPI failures never fall back to MCP, preventing a report from being silently submitted as the current user
• delegated submission requires AppKey/AppSecret and the “管理员工日志数据” permission
• --dry-run does not resolve, fetch, cache, or print an access token
• ordinary submissions remain backward compatible

Validation

• go test ./internal/helpers -run Report -count=1
• go test ./internal/app -run '^(TestReportSender|TestManualAgentExamplesContract)' -count=1
• go test ./internal/cli -count=1
• go vet ./internal/helpers ./internal/app ./internal/cli
• generated-drift, schema registry, runtime-confirmation, schema catalog, schema binary, skill command, and authoritative schema compatibility checks
• end-to-end dry-run verification for both delegated OAPI and ordinary MCP routes

Closes #406.
Supersedes #408.