What Problem This Solves

Feishu Drive folder listings return next_page_token, but the feishu_drive tool could not accept that cursor, leaving every page after the first unreachable.

This is the clean current-main replacement for #101249 and #101567. The original contributor branch was 159 main commits and 903 files behind; the first replacement then inherited merge-base noise when the verified GitHub commit path appended its rebased tree. This branch contains exactly the four intended Feishu files in one co-authored commit.

Why This Change Was Made

• Add bounded page_size and page_token inputs to the existing list action.
• Normalize folder and cursor tokens and validate page_size at runtime, not only in the model schema.
• Scope cursors to a concrete shared folder; Feishu bot credentials have no browsable root, so pagination is not forwarded for omitted, blank, or "0" folder tokens.
• Document one-page continuation in the bundled Feishu Drive skill.

The change stays plugin-local and preserves the existing response shape. It does not broaden into automatic recursive pagination or the separate info lookup behavior tracked by #93928.

User Impact

Agents can retrieve subsequent pages of a shared Feishu Drive folder by passing the returned next_page_token as page_token with the same folder_token. Invalid page sizes fail before an API request.

Evidence

• Upstream @larksuiteoapi/node-sdk source confirms drive.file.list accepts folder_token, page_size, and page_token, and returns next_page_token / has_more.
• Contributor gateway proof on fix(feishu): folder listings can continue after first page #101249 exercised /tools/invoke through the bundled tool and captured the expected SDK-boundary continuation request.
• Identical four-file tree proof on sanitized AWS: cbx_5bcffb4b507b, run run_5b84b967a00e; 20/20 Feishu Drive tests passed.
• oxfmt on all touched files; git diff --check; skill YAML frontmatter parse.
• Fresh GPT-5.5 autoreview of this exact four-file bundle: clean, confidence 0.86.
• Source-blind behavior validation: continuation and blank-cursor clauses passed from the public Gateway capture; invalid-size and root live clauses were blocked by unavailable credentials/harness and are covered by remote automated proof.
• Exact commit-head sanitized AWS and hosted CI/Testbox evidence will be posted before merge.

Closes the list continuation portion of #93928. Supersedes #101249 and #101567.