feat: add Slack draft approvals

[e1ektr0]

Summary

• add durable Slack draft approval cards with approve, edit, and reject actions
• resume approved drafts in the original session under normal tool authorization
• enforce exact approved message content across MCP preview, edit, and completion workflows
• add crash recovery, lease fencing, private DM routing, and bounded redaction

Validation

• focused approval, Slack, harness, run-store, and privacy suites passed
• TypeScript typecheck passed
• ESLint and oxlint passed
• changed-file Prettier and git diff checks passed
• Codex/OpenCode Linux adapter checks passed under WSL where available

Notes

• repository-wide formatting and knip retain unrelated baseline failures
• no schema migration is required

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[e1ektr0]

Closing this organization-specific delivery branch; no upstream contribution is requested at this time.