Add FT-WP-0001-T14: upload post images instead of linking them

The forge is closing (ORGREF-WP-0002 decision point 4).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

Assistant: claude-code
Assistant-Model: opus
Assistant-Process: 5457@bnt-lap001
Assistant-Session: 792bf84a-3783-4f5d-a811-cded61dd2012

workplans/FT-WP-0001-telegram-identity-and-hall-channel.md

@@ -434,3 +434,30 @@ cadence, rather than living inside a workplan that was supposed to finish.
 
 Do this once the loop has closed at least once (T12). Extracting a seam before
 you have used it is how you find out you cut it in the wrong place.
+
+## T14 — Upload post images instead of linking them
+
+```task
+id: FT-WP-0001-T14
+status: todo
+priority: high
+```
+
+The forge is closing (prj-forgejo-org-refactor ORGREF-WP-0002, decision
+`decisions/forge-visibility-policy.md` point 4). Telegram can then no longer fetch
+images from Forgejo raw URLs. The adapter fetches the image itself with a
+read-only forge identity, injected like the bot token and never logged, and
+uploads it to Telegram as a multipart `sendPhoto`. Editing an existing photo post
+replaces the media the same way.
+
+- `visual_url` stays the reference the reviewer signs off on; only the delivery
+  changes.
+- Refuse an image over Telegram's upload limit (10 MB for photos) rather than
+  resizing on the composer's behalf.
+- Tests: upload path with a fake forge and a fake Bot API; no credential in logs,
+  errors or the evidence store.
+- Verify with one signed test post to the private channel before
+  `hall-of-helix` or `pr-hall-of-helix` closes.
+
+No public asset location is improvised for this. A dedicated asset store with
+creator and trust management comes later, on its own.