Add native Slack Agent Channel

[mimeding]

Summary

• Adds a native Slack Agent Channel adapter with workspace/channel allowlists, read/search/send/thread routing, signed inbound event normalization, and conservative mention controls.
• Rebased onto the merged Agent Channel JSON runner, inbox/audit foundations, Settings IA cleanup, and current vmlx pin; native Slack dispatch now coexists with custom JSON channel execution.
• Stores Slack message snapshots in the shared Agent Channel message store after authorization and keeps bot credentials/signing secrets out of JSON config and diagnostics.
• Hardens channel safety: signed inbound events must target readable allowlisted channels, bot identity is required for self/echo suppression, user-group broadcasts are denied by default, and Slack form encoding now escapes reserved form characters.

Validation

• git diff --check origin/main...HEAD
• swiftlint lint Packages/OsaurusCore/Models/AgentChannel/AgentChannelConfiguration.swift Packages/OsaurusCore/Models/Slack/SlackConnectionConfiguration.swift Packages/OsaurusCore/Services/AgentChannel/AgentChannelConnectionManager.swift Packages/OsaurusCore/Services/AgentChannel/AgentChannelConnectionService.swift Packages/OsaurusCore/Services/Slack/SlackAPIClient.swift Packages/OsaurusCore/Services/Slack/SlackConnectionService.swift Packages/OsaurusCore/Tests/Slack/SlackConnectionTests.swift Packages/OsaurusCore/Tools/AgentChannelTools.swift
• OSAURUS_DISABLE_KEYCHAIN_FOR_TESTS=1 OSAURUS_TEST_ROOT=/tmp/osaurus-test-slack-post-rebase swift test --package-path Packages/OsaurusCore --filter SlackConnectionTests
• OSAURUS_DISABLE_KEYCHAIN_FOR_TESTS=1 OSAURUS_TEST_ROOT=/tmp/osaurus-test-slack-agent-channel-post-rebase swift test --package-path Packages/OsaurusCore --filter AgentChannelAsyncSubstrateTests

Draft gate

• Kept draft intentionally while GitHub CI reruns on the rebased branch.
• Keep draft until the final public channel registration/UI placement is confirmed.
• No prompt, default tool-schema, or model-routing changes are included, so no eval evidence is required for this service-level adapter refresh.