Slack: freeze command, identity, lifecycle, privacy, and event contracts

[jeffhuber]

Part of #903.

Problem

Slack integration needs a provider-neutral contract before worker code so it does not become a second orchestrator or duplicate Devin-specific lifecycle logic.

Scope

Define command/modal surfaces, normalized remote-session mapping, installation/actor/repository/channel identities, visibility, authorization, idempotency keys, inbox/outbox transitions, private/public data split, retention, safe error taxonomy, and closed Board/cloud event schemas. Use official Slack signed-request, three-second acknowledgement, retry, OAuth, and rate-limit contracts.

Dependencies

• Devin: reusable v3 client and lifecycle state machine #905

Acceptance criteria

• Slack is an ingress/conversation transport and is absent from participants/reviewer authority.
• Fixtures cover command, modal, retry, clarification, status, cancel, and cross-tenant rejection.
• No provider or live Slack dependency is added.
• The contract maps cleanly to the released/target Devin lifecycle and future registered Codex/Claude runners.

Code Mower delivery

Produce exactly one independently reviewable PR for this issue. Record the named builder, keep one writer on the branch, run focused tests and applicable full checks, obtain an independent Code Mower review against the exact current head, resolve every P0/P1/P2 finding, and pass normal CI plus code-mower/gate. Update the parent epic with PR/head, review, validation, outcome, and safe metadata-only upload evidence. Do not put credentials, source, diffs, prompts, transcripts, private context, task/message prose, or raw provider output in cloud data.