[Bug] --no-reactions still requires im:message.reactions:read in +chat-messages-list

Summary

lark-cli im +chat-messages-list --no-reactions still fails its scope pre-flight unless im:message.reactions:read is granted. With reactions explicitly disabled, the shortcut should not require the reactions scope.

Environment

• lark-cli: 1.0.87 (also reproduced on 1.0.84)
• OS: macOS arm64
• identity: user
• relevant granted scopes: im:message:readonly, im:chat:read
• not granted: im:message.reactions:read

Steps to reproduce

lark-cli im +chat-messages-list \
  --as user \
  --chat-id oc_xxx \
  --page-size 1 \
  --order desc \
  --no-reactions \
  --format json

Actual behavior

The command exits before sending the message-list request:

{
  "ok": false,
  "identity": "user",
  "error": {
    "type": "authorization",
    "subtype": "missing_scope",
    "message": "missing required scope(s): im:message.reactions:read",
    "missing_scopes": ["im:message.reactions:read"]
  }
}

It also suggests running auth login for the reactions scope.

Control test

Calling the underlying endpoint through the raw API succeeds with the existing message-read permission and returns the requested message:

lark-cli api GET /open-apis/im/v1/messages \
  --as user \
  --params '{"container_id_type":"chat","container_id":"oc_xxx","page_size":1,"sort_type":"ByCreateTimeDesc"}'

Expected behavior

When --no-reactions is present:

1. Skip reaction enrichment.
2. Do not pre-flight im:message.reactions:read.
3. Fetch the message list using the base message/chat read permissions.

Impact

The current behavior creates a false authorization blocker and guides agents/users to request an unrelated scope even though the requested message history is readable.

This was previously mentioned as a side observation in #1031, but that issue tracks message-link generation rather than this scope/pre-flight bug.

Start at the im +chat-messages-list entry point and trace its scope pre-flight and reaction-enrichment handling. Reproduce the command with --no-reactions and the raw /open-apis/im/v1/messages control request. Done means the no-reactions path skips reaction enrichment and does not require im:message.reactions:read, while the message list still loads with base permissions.