[bug] lark-im skill: images.create mislabeled "bot only" — user identity (UAT + im:resource) uploads and sends media fine

[hunshcn]

Summary

The lark-im skill (SKILL.md API table) marks images.create as:

create — 上传图片。Identity: bot only (tenant_access_token).

This is inaccurate and contradicts the skill's own send/reply references. It misleads agents into believing media messages cannot be sent with --as user, or into unnecessary workarounds (upload as bot, then reference the key as user).

Evidence (tested 2026-08-04, lark-cli with user identity authorized, granted scopes include im:message.send_as_user, im:message, im:resource)

# 1. Local image uploaded + sent as user — succeeds
lark-cli im +messages-send --chat-id oc_xxx --as user --image ./test.png
# => ok: true, sender_type: "user"

# 2. Local file uploaded + sent as user — succeeds
lark-cli im +messages-send --chat-id oc_xxx --as user --file ./test.txt
# => ok: true, sender_type: "user"

Both messages were verified via +messages-mget: sender.sender_type = "user", sent as the authorized end user.

Inconsistencies in the skill

1. SKILL.md API table: images.create labeled bot only (tenant_access_token) — wrong, or at least incomplete: with a UAT that includes im:resource, user-identity image upload works.
2. The same table has no files.create entry at all (file upload), even though +messages-send --file / +messages-reply --file upload files.
3. references/lark-im-messages-send.md (line ~268) and references/lark-im-messages-reply.md (line ~267) correctly state: "both the upload and send steps use the same identity (UAT when --as user, TAT when --as bot)" — this contradicts the SKILL.md table.

Suggested fix

• Change images.create identity annotation to supports user and bot, noting user identity requires the im:resource scope on the UAT.
• Add a files.create entry with the same annotation.
• Optionally add one line to SKILL.md's "Identity and Token Mapping" section: media upload follows the caller's identity; user identity requires im:resource.