What Problem This Solves

Part 3 (final) of #112238 — the type Jesse's original observation was about. ChannelSetupInput in core was a ~50-field union of every channel's setup vocabulary (botToken, signalNumber, homeserver, ship, cliPath, ...), exported as public SDK surface. Core declared every channel's fields; plugins read their own off the shared bag.

Why This Change Was Made

Per the SDK migration policy (new contract → deprecation window → removal at major):

• ChannelSetupInput is now ChannelSetupEnvelope & DeprecatedChannelSetupFields. The envelope keeps the genuinely cross-channel fields (name, token, tokenFile, useEnv, allowFrom, defaultTo); all 43 channel-owned fields move to a clearly-bounded deprecated tier with identical value types and per-field @deprecated JSDoc pointing at the plugin-local pattern and the removal milestone (next Plugin SDK major).
• Every in-repo plugin now declares its own setup-input type locally (SlackSetupInput, MatrixSetupInput, ...); a compatibility-off compile proof (deprecated tier temporarily disconnected, full core+extensions typecheck lanes green) shows in-repo code no longer touches the tier — it exists purely for third parties.
• No index signature: the type stays structurally assignable exactly as before, so interface-typed third-party inputs keep compiling. Unknown plugin keys remain a runtime fact that plugin-local types/schemas narrow at the adapter boundary (an earlier draft intersected Record<string, unknown>; review showed that breaks interface assignability and was never needed — withdrawn).
• A type fixture (expectTypeOf + interface-assignability guard) locks the contract, deliberately covering the API-baseline blind spot: the baseline renders re-exported type aliases by name and produced byte-identical hashes across this change, so the fixture is the field-level guard.
• docs/plugins/sdk-migration.md records the deprecation and removal window; docs/plugins/sdk-setup.md documents the envelope + plugin-local pattern.

Third-party impact verified by tarball inspection of all four published out-of-tree plugins (WeCom, Yuanbao, Weixin, Zalo ClawBot): zero runtime impact (compiled dist), zero rebuild break (deprecated tier + preserved assignability).

User Impact

None at runtime. Plugin authors get deprecation guidance in their IDE and a documented migration pattern; the actual field removal is reserved for the next SDK major.

Evidence

• Compatibility-off compile proof: tsgo:core + tsgo:extensions green with the deprecated tier disconnected (Blacksmith run 29837400152), tier restored after; final full type lanes green (core, core:test, extensions, extensions:test — rerun locally after the assignability correction during a Blacksmith outage, noted as the sanctioned fallback).
• Type fixture + SDK surface/api checks green; API baseline byte-identical (blind spot confirmed, fixture guards).
• Focused setup suites green (slack, matrix, nextcloud-talk, tlon + fixture, 60 tests in the final round).
• Structured review (Codex gpt-5.6-sol): one P1 accepted and fixed (index-signature intersection broke interface assignability — removed); final run clean, 0.97.