Phase 3: unified webhook follow-ups

[chaodu-agent]

Follow-up items from PR #1171 (unified webhook runtime)

Tracked items from group review — non-blocking improvements for the unified webhook path.

Tasks

• Add GATEWAY_ALLOW_BOT_MESSAGES / GATEWAY_TRUSTED_BOT_IDS env — process_gateway_event() currently drops all bot messages; multi-agent scenarios need trusted bot passthrough.
• Wire Google Chat in unified mode — Currently google_chat: None with TODO; needs SA key parsing + JWT verifier initialization.
• Deduplicate event processing logic — process_gateway_event() and run_gateway_adapter() share filtering/dispatch logic that should be extracted into a shared helper.
• Extract AppState::from_env() factory — Avoid unified/standalone config divergence by sharing initialization.
• Document production-must-set env vars — GATEWAY_ALLOW_ALL_CHANNELS, GATEWAY_ALLOW_ALL_USERS default fail-open; flag in Helm/deploy docs.
• Add user-facing fallback when create_thread fails — Server-side tracing::warn added; user-facing message removed due to ordering issues on Telegram/LINE (warning appeared before reply). Needs a deferred-message approach to show after reply.
• Log when audio attachment path/data both empty — Currently silent skip with no trace.

Context

• PR: feat: wire up unified webhook runtime (Phase 2) #1171
• Parent tracking: Workspace restructure follow-ups (post #1146) #1170
• Reviewers flagged these as non-blocking improvements during group review.
• Fixed in: feat(gateway): Phase 3 quick fixes — bot filter, fallback, logging, docs #1173 (merged)

cc @pahudnet

[github-actions]

Thanks for the report! A maintainer will triage this shortly and apply the appropriate label. Once a type label is added, the issue will be re-validated automatically.