fix(line): read the standalone-send token through _credentials and pin both strips

_standalone_send still read the access token raw, so a blank or newline-padded token went out as the Bearer header; reuse the hardened _credentials. Pin the token half of the null/blank guard and the env presence strip (both reverted green before). Gate r4 Lows.

plugins/platforms/line/adapter.py

@@ -932,8 +932,7 @@ async def _standalone_send(
 ) -> Dict[str, Any]:
     """Out-of-process Push delivery for cron jobs detached from the gateway (no inbound event → no
     reply token). ``thread_id`` is ignored (no threads); ``media_files`` need the webhook server."""
-    extra = getattr(pconfig, "extra", {}) or {}
-    token = _get_scoped_secret("LINE_CHANNEL_ACCESS_TOKEN") or extra.get("channel_access_token", "")
+    token = _credentials(pconfig)[0]
     if not token or not chat_id:
         return send_error("LINE standalone send: missing token or chat_id")
     messages = _text_messages(message or "") or [_text_message("")]

tests/gateway/test_line_plugin.py

@@ -367,6 +367,8 @@ class TestCheckRequirements:
         monkeypatch.setenv("LINE_CHANNEL_ACCESS_TOKEN", "t")
         monkeypatch.delenv("LINE_CHANNEL_SECRET", raising=False)
         assert not check_requirements()
+        monkeypatch.setenv("LINE_CHANNEL_SECRET", "   ")
+        assert not check_requirements()
 
 
 class TestValidateConfig:
@@ -420,6 +422,8 @@ class TestAdapterInit:
         for blank in ("   ", None):
             assert LineAdapter(PlatformConfig(enabled=True, extra={"channel_access_token": "tok",
                                                                    "channel_secret": blank})).channel_secret == ""
+            assert LineAdapter(PlatformConfig(enabled=True, extra={"channel_access_token": blank,
+                                                                   "channel_secret": "sec"})).channel_access_token == ""
         assert ad.webhook_port == 7777
         assert ad.public_base_url == "https://x.example.com"
         assert ad.allowed_users == {"U1", "U2"}