feat(telegram): Phase 2 — deliver uploaded files to agent workspace (#354 follow-up)

[vybe]

Summary

Complete Phase 2 of #354: actually deliver files uploaded via Telegram into the agent workspace at /home/developer/uploads/ and inject a chat message so the agent sees the upload. Phase 1 (PR #355) shipped extraction, download, magic-byte MIME validation, size checks, and audit logging — but files are currently logged and dropped, not handed to the agent.

Context

PR #355 closed #354 as "Phase 1" with an explicit deferral:

Files are validated and logged but not yet delivered to agent workspace — that's Phase 2.

Right now a user can send a photo or document to an agent's Telegram bot and the backend will download, validate, and audit it — but the agent itself never sees the file. This issue tracks closing that gap for Telegram. Slack and public-link channels are tracked separately (see #354 "Out of Scope" and #222/#282 for Slack).

Acceptance Criteria

• After successful validation in telegram_adapter/message_router, persist the downloaded bytes to the target agent's workspace at /home/developer/uploads/{sanitized_filename}
• Filename sanitization: strip path traversal (.., /, \), normalize unicode, truncate to a sane length, de-dupe on collision (e.g. suffix -1, -2)
• Inject a system/user chat message into the agent's stream in the documented format: [File uploaded by {verified_email}]: {filename} ({size}) saved to /home/developer/uploads/{filename}
• Delivery path works for both photos (largest size variant) and documents
• Audit log entry records the final stored path (extend the existing Phase 1 audit entry or add a file_delivered event)
• Failure modes are graceful: if workspace write fails, the user gets a clear error message back in Telegram and nothing is injected into the chat stream
• Unit tests cover: filename sanitization, collision handling, workspace write failure, chat injection format
• docs/memory/feature-flows/telegram-integration.md updated with the Phase 2 delivery flow

Technical Notes

• Phase 1 code lives in src/backend/adapters/telegram_adapter.py (_extract_files, download_file) and src/backend/adapters/message_router.py (validation + audit).
• Workspace write needs to go through the agent container — look at how existing agent-workspace writes are done (credentials injection via routers/credentials.py is one precedent; docker_service / agent_client may be involved).
• Chat injection: reuse whatever primitive Phase 1 uses to route the user's text message to the agent, just prepend/replace with the file-upload notice.
• Out of scope (per feat: File upload support for external channels (Telegram, Slack, public links) #354): per-user namespaced folders, storage quotas, retention/cleanup, virus scanning, voice/video/stickers.

Related

• Parent: feat: File upload support for external channels (Telegram, Slack, public links) #354 (closed — Phase 1 only)
• Phase 1 PR: feat(telegram): file upload support Phase 1 (#354) #355
• Slack inbound files: see feat: Bidirectional file sharing via Slack (SLACK-FILES) #222 (closed) / separate follow-ups
• Web chat file upload: feat(chat): file upload support for web chat #364