Implement the avatar and a preflight dry run

The avatar is now applied rather than deferred: BotFather's /setuserpic is a
conversation in which you send a photo, so the file is uploaded and sent as
a message. It is content addressed -- replacing the file is what triggers an
update, and the digest is recorded only after BotFather confirms, so a failed
upload retries rather than being remembered as done. The image is validated
before the conversation starts, because an image rejected halfway leaves the
bot registered without a picture.

Adds `provision preflight`: spec, avatar, OpenBao reachability, credentials,
session presence, salt and the resulting plan, checked in one run that writes
nothing and never contacts Telegram. Every failure it reports is one that
would otherwise surface after a phone number had been spent.

Two bugs it found immediately. The avatar path is documented as repo-relative
but resolved against the spec's own directory, so the real campaign spec
failed to find its own asset. And the OpenBao error named both variables when
only one was missing, sending the reader to check the one already set.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0172sgCZEEDJcnQmr4SGDvKa

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 1361245@bnt-lap001
Assistant-Session: b3b428ef-f3e6-4688-b091-01f71461d66a

internal/tg/botfather.go

@@ -7,6 +7,7 @@ import (
 	"strings"
 	"time"
 
+	"github.com/gotd/td/telegram/uploader"
 	"github.com/gotd/td/tg"
 )
 
@@ -205,3 +206,49 @@ func firstLine(s string) string {
 	}
 	return s
 }
+
+// SetAvatar sends the bot's profile picture through BotFather.
+//
+// A bot's picture cannot be set through any API: /setuserpic is a conversation
+// in which you send a photo, so the file is uploaded and then sent as a message
+// like a person would send it.
+func (conv *Conversation) SetAvatar(ctx context.Context, username, path string) error {
+	reply, err := conv.Ask(ctx, "/setuserpic")
+	if err != nil {
+		return err
+	}
+	if strings.Contains(strings.ToLower(reply), "choose a bot") ||
+		strings.Contains(reply, "/") {
+		if _, err := conv.Ask(ctx, "@"+username); err != nil {
+			return err
+		}
+	}
+
+	pause()
+	up := uploader.NewUploader(conv.c.api)
+	file, err := up.FromPath(ctx, path)
+	if err != nil {
+		return fmt.Errorf("upload avatar %s: %w", path, err)
+	}
+
+	randID, err := conv.c.client.RandInt64()
+	if err != nil {
+		return err
+	}
+	if _, err := conv.c.api.MessagesSendMedia(ctx, &tg.MessagesSendMediaRequest{
+		Peer:     conv.peer,
+		Media:    &tg.InputMediaUploadedPhoto{File: file},
+		RandomID: randID,
+	}); err != nil {
+		return fmt.Errorf("send avatar to @%s: %w", botFatherUsername, err)
+	}
+
+	reply, err = conv.awaitReply(ctx)
+	if err != nil {
+		return err
+	}
+	if !strings.Contains(strings.ToLower(reply), "success") {
+		return fmt.Errorf("@%s did not confirm the picture: %q", botFatherUsername, firstLine(reply))
+	}
+	return nil
+}