Release: qualify and publish Slack session ingress in v1.5.0

[jeffhuber]

Part of #903.

Problem

Slack requires adversarial retry/privacy evidence and a real private-workspace canary before public release.

Scope

Run duplicate/delayed/replayed delivery, rate-limit, revoked token, cross-tenant, Slack Connect, uncertain Devin create, clarification race, cancellation, Coworker/Graphify context selection, Board, cloud, retention, fresh-install, and package qualification. Publish version/docs/artifacts, install from PyPI, run the release campaign, refresh Board, and verify CodeMower.com ingestion.

Dependencies

• Slack: optional integration setup, doctor, and operating guidance #922
• Release: publish and qualify Board clarity v1.4.2 #952 — Board v1.4.2 release/readiness. This gates only the private end-to-end
  canary and final Slack lifecycle/release acceptance; it does not block the
  earlier Slack implementation children.

Acceptance criteria

• Every required Slack epic child is closed with exact-head audit and gate evidence.
• A private workspace canary completes one reviewed result without leaking prose.
• The canary's local lifecycle is visible through the released provider-neutral
  Board projection; Slack-specific and hosted/cloud mappings remain Slack: metadata-only Board and CodeMower.com lifecycle telemetry #921.
• Default no-Slack install remains unchanged.
• GitHub/PyPI v1.5.0, package rehearsal, campaign, Board, and allowlisted cloud ingestion all pass.
• Limitations and follow-ons are explicit.

Code Mower delivery

Produce exactly one independently reviewable PR for this issue. Record the named builder, keep one writer on the branch, run focused tests and applicable full checks, obtain an independent Code Mower review against the exact current head, resolve every P0/P1/P2 finding, and pass normal CI plus code-mower/gate. Update the parent epic with PR/head, review, validation, outcome, and safe metadata-only upload evidence. Do not put credentials, source, diffs, prompts, transcripts, private context, task/message prose, or raw provider output in cloud data.