feat: add config bind command for Agent credential workspace isolation

Add `lark-cli config bind --source openclaw|hermes` to sync AI Agent
Feishu credentials into isolated lark-cli workspace subtrees.

- Workspace routing: core.SetCurrentWorkspace / GetRuntimeDir with
  atomic.Value for concurrency safety; existing GetConfigDir delegates
  transparently (zero behavior change for local workspace)
- OpenClaw SecretRef resolution: 4 forms (plain, ${VAR} template,
  file with JSON Pointer, exec with JSON protocol) aligned with
  OpenClaw src/secrets/resolve.ts including full security audit
  (absolute path, symlink, owner uid, permission bits, trustedDirs)
- Hermes .env parsing: reads ~/.hermes/.env with HERMES_HOME override
- TUI + flag dual mode: language → source → account → conflict prompt
  → security disclaimer, matching config init interactive style
- Keychain integration via ForStorage; --force cleanup of old entries
- config show / doctor output: workspace field added
- 75+ unit tests covering success paths, error branches, exec provider
  shell scripts, audit security checks, types marshaling

Author: evandance

CHANGELOG.md

@@ -2,6 +2,12 @@
 
 All notable changes to this project will be documented in this file.
 
+## Unreleased
+
+### Features
+
+- Add `config bind` command to sync AI Agent (OpenClaw / Hermes) credentials into isolated lark-cli workspaces; supports TUI + flag dual mode, OS keychain storage, OpenClaw SecretRef resolution, and per-workspace runtime artifact isolation
+
 ## [v1.0.13] - 2026-04-16
 
 ### Features