[RohanAdwankar]

Description

Add optional Microsoft Teams messaging through OpenClaw's native msteams plugin, pinned to 2026.6.10 to match the current runtime. Bot credentials come from an existing Kubernetes Secret. An optional ingress routes only /api/messages to the Teams webhook on port 3978.

Support direct messages, configured team/channel conversations, and native proactive delivery targets for alert explanations. Preserve Slack configuration when both channels are enabled. Document tenant registration, app installation, conversation initialization, and scheduled delivery; refresh the bundled agent documentation.

Checklist

• I am familiar with the Contributing Guidelines.
• Every commit is signed off under the Developer Certificate of Origin.
• New or existing validation covers these changes.
• Documentation is up to date with these changes.

[JeffPengCoder]

Validation update and follow-up fixes: #76 targets this PR's feat/teams-channel source branch.

Validated the pinned OpenClaw / msteams 2026.6.10 combination on ARM64 kind:

• The original five Teams chart tests and Helm lint passed.
• The native plugin installed and loaded, and its runtime configuration validated.
• An unsigned POST /api/messages on port 3978 returned 401; Gateway /healthz returned 200.
• A persistent deployment using the existing OpenClaw PVC loaded the same plugin after recreating the Pod; the Teams init container exited successfully.

Two reproducible gaps are addressed in #76:

1. The documented scheduled delivery is disabled by the hard-coded cron.enabled=false. Add an explicit, default-off openclaw.cron.enabled value and document the opt-in.
2. The nonempty-list check accepts allowedUserIds: ["*"] and [""]. The pinned runtime confirms * matches any sender. Require concrete Entra user GUIDs and reject malformed entries and empty credential key names.

The follow-up also adds optional credential-free preinstallation (install=true, messaging/listeners still disabled) and clarifies tenant registration, the Microsoft developer CLI, HTTPS routing, app installation, and real delivery acceptance.

Follow-up validation: 220 repository tests, 218 passed, 2 existing conditional skips, 0 failed; 8 Teams-focused tests passed; 4 standalone inference tests passed; stack/preinstallation/inference lint, documentation bundle check, and whitespace checks passed.

These component checks do not claim an authenticated tenant message round trip, proactive delivery, or a phone notification. Those still need real bot credentials, a reachable HTTPS callback, application installation, conversation initialization, and tenant-side acceptance tests.

Additional real-environment onboarding checks: the Microsoft developer CLI retained a successful login in a fresh process after repairing its native credential-cache dependency. The independent Microsoft Dev Tunnels login also succeeded; a named development tunnel and its local forwarding services were hosted and restarted. This is a development ingress, not a production SLA claim. Entra application creation was then rejected with HTTP 403 (Insufficient privileges to complete the operation). No bot credentials were generated, so messaging remains disabled and real tenant delivery is still pending the organization's application-registration approval or an existing approved bot. This demonstrates why customer-managed registration and app-installation prerequisites must remain explicit. No internal host addresses, user identity, tunnel URLs, or credentials are included here.

The #76 Tests and Documentation build checks both completed successfully.

I have read-only access to the upstream repository, so #76 contains the signed-off fixes for the author to merge into this branch rather than changing this PR's head directly.