Slack: Devin dispatch, clarification, completion, and cancellation bridge

[jeffhuber]

Part of #903.

Problem

Slack tasks need a released execution backend with progress and two-way clarification; hosted Devin is the first production transport.

Scope

Dispatch through the v1.4.0 provider-neutral lifecycle, poll with bounded backoff, coalesce status, discover waiting-for-user messages, collect answer modals, send checkpointed answers, expose approval links without bypassing Devin safe mode, collect verified PR completion, and terminate/archive after confirmed cancellation.

Dependencies

• Slack: durable inbox/outbox and start/status/cancel interaction #919
• Release: publish and qualify Code Mower v1.4.0 with Devin peer support #912

Acceptance criteria

• Uncertain create/send/post outcomes reconcile or require explicit retry without duplication.
• Waiting-for-user and waiting-for-approval remain distinct.
• Rate limits and retry-after responses do not lose state or flood a channel.
• One private canary completes and one cancellation canary terminates cleanly.
• Task and message prose remains private.

Code Mower delivery

Produce exactly one independently reviewable PR for this issue. Record the named builder, keep one writer on the branch, run focused tests and applicable full checks, obtain an independent Code Mower review against the exact current head, resolve every P0/P1/P2 finding, and pass normal CI plus code-mower/gate. Update the parent epic with PR/head, review, validation, outcome, and safe metadata-only upload evidence. Do not put credentials, source, diffs, prompts, transcripts, private context, task/message prose, or raw provider output in cloud data.