{examples, ci}: add Telegram live E2E example and CI workflow

[XnLemon]

Implements #33

Parent #32 is merged into main; this follow-up PR targets main.

Evidence

Outcome

• Adds examples/telegram-e2e/ with a real github.com/go-telegram/bot receiver path.
• Exercises getMe -> getUpdates -> trusted RoutingTarget -> deterministic DispatchService -> sendMessage.
• Builds the target through the existing tenant/app/binding/verifier boundary; it does not call Runner directly.
• Supports local human-driven marker messages and a second controlled Bot for automated CI round trips; the sender secret is required by CI and optional only for local runs.
• Reads Bot tokens only from runtime environment variables and keeps errors/logs redacted.
• Adds safe Webhook preflight/deletion controls and bounded cancellation.
• Adds .github/workflows/telegram-e2e.yml, manual-only, protected Environment, required live-secret preflight, and one-poller concurrency.
• Documents the transport-only scope and keeps the existing offline CI credential-free.

Issue ledger

• Runnable root examples/telegram-e2e/ example.
• Production Telegram SDK in the live path; fake BotFactory remains limited to existing offline tests.
• Runtime-only TELEGRAM_BOT_TOKEN and TELEGRAM_SENDER_BOT_TOKEN; both are required by CI, while the sender is optional only for local human-driven runs. No credential persistence or logging.
• Trusted active Telegram RoutingTarget and DispatchService path.
• Exact Bot identity validation through the Adapter's getMe.
• Webhook conflict handling and explicit pending-update behavior.
• Deterministic Dispatcher so model-provider credentials are not required for transport E2E.
• Bounded timeout, cancellation, one reply round trip, and redacted failure categories.
• Manual workflow_dispatch job with protected telegram-e2e Environment and serialized polling.
• Explicit inbound-message strategy for local human runs versus CI sender Bot.
• Documentation for secrets, Bot-to-Bot test setup, ordinary-text-only scope, and non-goals.
• Existing offline CI remains independent of Telegram credentials.
• Live GitHub workflow execution: the protected Environment secrets are configured, but GitHub cannot dispatch a workflow that exists only on this PR branch before merge. The manual live run remains the post-merge operational test; no live credentials were used in this PR.

Validation

• go test ./... -count=1
• go test -race ./... -count=1
• go vet ./...
• go build ./...
• ./scripts/format.sh --check
• ./scripts/lint.sh
• python -m mkdocs build --strict -f docs/mkdocs.yml
• git diff --check
• Credential-pattern scan clean; the previously exposed Bot token was not used or committed.

The live workflow cannot be dispatched pre-merge because GitHub registers workflow_dispatch only from the default branch; the manual run remains the post-merge operational test.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[XnLemon]

LGTM

[XnLemon]

LGTM