fix(telegram): preserve group authorization union

[konsisumer]

What does this PR do?

Restores the documented Telegram authorization union at the intake security boundary. A global allow_from user may use the bot in groups, and either group_allow_from or group_allowed_chats can grant group access without opening direct messages. The runner now applies the same config-only decision, so it cannot reject an event that intake accepted.

Related Issue

Fixes #68716

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• 🔒 Security fix
• ✨ New feature (non-breaking change that adds functionality)
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• gateway/authz_mixin.py: centralizes Telegram config allowlist evaluation and applies the global, group-user, and group-chat grants as an OR-union.
• plugins/platforms/telegram/adapter.py: uses that shared decision before event construction, batching, or observation.
• tests/gateway/test_telegram_auth_check.py: covers config and environment equivalence, each scoped grant, direct-message denial for group-only users, and preserved early rejection.

How to Test

1. Run /opt/homebrew/bin/timeout -k 30 480 sh -c 'pytest tests/gateway/test_telegram_auth_check.py -q --timeout=60'.
2. Run PATH="$VIRTUAL_ENV/bin:$PATH" /opt/homebrew/bin/timeout -k 30 480 sh -c 'pytest tests/ -q -x --timeout=60 "$@"' sh.
3. Confirm a globally allowed user, a group-allowed user, and an arbitrary member of an allowed group are accepted in groups, while an unlisted member and a group-only user in a DM are rejected.

What platforms tested on

• macOS (darwin-arm64) locally with the project virtual environment.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: macOS (darwin-arm64)

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) — or N/A
• I've updated cli-config.yaml.example if I added/changed config keys — or N/A
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows — or N/A
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide — or N/A
• I've updated tool descriptions/schemas if I changed tool behavior — or N/A

[konsisumer]

Closing — fix(telegram): preserve group authorization union makes empty config lists reject existing group-gating tests. If this still seems valuable, please reopen with feedback on what to change.