GHSA-vj3g-5px3-gr46: OpenClaw vulnerable to path traversal in Feishu media temp-file naming allows writes outside os.tmpdir()

OpenClaw’s Feishu media download flow used untrusted Feishu media keys (imageKey / fileKey) when building temporary file paths in extensions/feishu/src/media.ts. Because those keys were interpolated directly into temp-file paths, traversal segments could escape the temp directory and redirect writes outside os.tmpdir().