feat: add Telegram file attachment support (inbound + outbound)

Inbound:
- tg-ingest detects document/photo/audio/video/voice attachments
- Downloads files via Telegram Bot API (getFile + download)
- Inlines small text files (<50KB) directly in the prompt
- Stores binary/large files to S3 (attachments/{chat_id}/{update_id}/{filename})
- agent-runner appends file context to the AgentCore prompt

Outbound:
- New send_file tool for the agent to send documents back to users
- TelegramAdapter.send_document uses multipart/form-data POST
- CDK grants tg-ingest S3 write access and passes bucket name env var

cdk/lib/agent-claw-stack.ts

@@ -96,10 +96,12 @@ export class AgentClawStack extends cdk.Stack {
         MESSAGE_QUEUE_URL: messageQueue.queueUrl,
         TELEGRAM_BOT_TOKEN_SECRET_ARN: telegramBotTokenSecretArn,
         TELEGRAM_WEBHOOK_SECRET: '', // set via SSM or direct env after deploy
+        ATTACHMENTS_BUCKET_NAME: workspaceBucket.bucketName,
       },
     });
     messageQueue.grantSendMessages(tgIngestFn);
     botTokenSecret.grantRead(tgIngestFn);
+    workspaceBucket.grantWrite(tgIngestFn);
 
     // ── Lambda: agent-runner ───────────────────────────────────────────────
     const agentRunnerFn = new lambda.Function(this, 'AgentRunner', {