Remote workbench: make CNB, Lighthouse, and Feishu feel like one flow

[Hmbown]

Problem

CodeWhale already has CNB mirror docs, Tencent Lighthouse setup, and Feishu/Lark bridge pieces, but the user experience still reads like operator notes. To become a practical remote workbench, the flow should feel coherent: source -> deploy/build -> runtime -> phone control -> verification -> rollback.

Scope

For v0.8.46, improve the Tencent/CNB remote-first workbench path without exposing private runtime APIs by default.

• Add a concise remote-workbench checklist that verifies GitHub and CNB refs, release tags, and branch mirrors.
• Improve the Lighthouse setup path around /opt/whalebro, systemd units, rebuild/install, restart, and rollback.
• Make Feishu/Lark DM workflows clearer for status, thread selection, resume, interrupt, approvals, and service restart.
• Add copy-pasteable health checks for runtime, bridge, CNB ref parity, and service persistence after reboot.
• Keep codewhale serve --http bound to 127.0.0.1 unless the user explicitly configures exposure.
• Keep group control and public webhook/EdgeOne paths behind explicit allowlists and risk notes.

Acceptance criteria

• A user can set up a private always-on CodeWhale workspace from the CNB mirror without relying on GitHub at runtime.
• The docs make it obvious which component owns source, build/deploy, runtime, phone control, and public edge.
• The flow includes rollback and failure diagnosis, not only happy-path setup.
• Runtime tokens and private APIs are not exposed by default.

Related tracker: #1880
Related CNB/Tencent docs: docs/CNB_MIRROR.md, docs/TENCENT_CLOUD_REMOTE_FIRST.md, docs/TENCENT_LIGHTHOUSE_HK.md

[Hmbown]

Added RustProxy as a separate v0.8.46 evaluation spike: #1989. Keeping it as an audit/proof-of-topology task before any dependency, docs recommendation, or tunnel wrapper lands.

[Hmbown]

Added a US/global counterpart to the Tencent/Lighthouse lane: #1990. Current recommendation to evaluate is AWS Lightsail for the always-on runtime, Cloudflare Tunnel/Workers for the public edge/webhook layer, and Telegram first for phone control, with Discord/Slack as follow-ons.