Apply Telegram channel learnings to WhatsApp implementation

- Fix metadata flow: store sender_phone for response routing
- Add credential injection in headers (Bearer {WHATSAPP_ACCESS_TOKEN})
- Add secret_validated check for webhook defense in depth
- Add status message filtering to prevent loops
- Add proper WhatsApp API error response parsing
- Create whatsapp.capabilities.json with setup/secrets/rate limits
- Add docs/BUILDING_CHANNELS.md with patterns and examples

Also fix UTF-8 truncation bugs across codebase:
- wrapper.rs: content preview, response body, webhook body logging
- agent_loop.rs: params truncation for approval display
- shell.rs: truncate_for_error() helper

Co-Authored-By: Claude Opus 4.5 <[email protected]>

src/tools/builtin/shell.rs

@@ -403,12 +403,12 @@ fn truncate_output(s: &str) -> String {
     }
 }
 
-/// Truncate command for error messages.
+/// Truncate command for error messages (char-aware to avoid UTF-8 boundary panics).
 fn truncate_for_error(s: &str) -> String {
-    if s.len() <= 100 {
+    if s.chars().count() <= 100 {
         s.to_string()
     } else {
-        format!("{}...", &s[..100])
+        format!("{}...", s.chars().take(100).collect::<String>())
     }
 }