feat(qq): parse inbound QQ face/emoji tags into readable text

QQ delivers emoji messages as opaque <faceType=..,faceId="..",ext="..">
markup fragments (the ext field holds a base64 JSON blob with the face
name, e.g. {"text":"吃瓜"}). Without translation, the Harness receives
only this unusable tag and loses what the sender actually meant.

Register the SDK's contentSanitizer({ parseFaceTags: true }) middleware,
mirroring tencent-connect/dsh-qqbot, so C2C and group inbound messages
surface as e.g. 【表情: 吃瓜】 instead of the raw tag.

- qq-runtime.mjs: register contentSanitizer before the typing indicator
- runtime.test.mjs: assert sanitizer registration and update middleware order
- lib/index.js: regenerated host bundle

src/channels/qq/qq-runtime.mjs

@@ -1,4 +1,4 @@
-import { QQBot, typingIndicator } from '@tencent-connect/qqbot-nodejs';
+import { QQBot, contentSanitizer, typingIndicator } from '@tencent-connect/qqbot-nodejs';
 
 import {
   connectionTestTarget,
@@ -171,6 +171,10 @@ export class QqRuntime {
       replyTimeoutMs: this.#replyTimeoutMs,
       signal: controller.signal,
     });
+    // QQ delivers emoji/face messages as opaque `<faceType=..,faceId="..",ext="..">`
+    // tags. Parse them into readable text so the Harness sees what the sender
+    // actually meant instead of an unusable markup fragment.
+    bot.use(contentSanitizer({ parseFaceTags: true }));
     bot.use?.(this.#typingMiddleware({
       keepAlive: true,
       predicate: (ctx) => this.#config.ownerUserOpenid === '*'