Investigate bot IM search token failure in managed lark-cli workspace

[eddiearc]

larkin im +messages-search fails in the managed Bot workspace while Inbox polling and known-chat history reads work.

Reproduction:

larkin im +messages-search --query openai.com --page-size 50 --no-reactions --json

Observed:

• error: 99991663 Invalid access token for authorization
• command exit: 3
• Feishu log ID: 2026090216480478ECCC3DA5BB73C6A33D
• dry run first request: POST /open-apis/im/v1/messages/search
• runtime: Larkin 0.4.22; effective @larksuite/cli 1.0.87; identity: bot

This looks endpoint-specific: bot Inbox and known-target +chat-messages-list work. Larkin forwards this shortcut as passthrough and only provides the managed Bot workspace/config. The official CLI 1.0.85 changelog added Bot support for search shortcuts, which makes its identity/token selection path a likely cause.

Expected: +messages-search uses the same Bot/TAT credential provider and refresh/cache behavior as other Bot IM read shortcuts.

Suggested follow-up:

1. Reproduce using a managed external Bot workspace.
2. Compare credential selection for +messages-search vs +chat-messages-list / +messages-mget.
3. Scope token-cache entries by identity and add an integration test for Bot search.