[Feat] Add shared Slack support channels

[roomote-roomote]

Opened on behalf of Matt Rubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

• Added an admin-only Roomote Cloud action that creates a dedicated private Slack channel and sends a Slack Connect invitation to a server-configured Roomote support address.
• Added clear not-started, permissions-needed, invitation-pending, connected, and action-needed states plus a confirmation warning before external sharing.
• Limited the additional Cloud Slack scopes to groups:write and conversations.connect:write; self-hosted Slack manifests and OAuth installs remain unchanged.
• Made provisioning retry-safe with persisted workspace/channel state, deterministic channel reconciliation, and a renewable distributed lock around Slack side effects.
• Extended the mock Slack API, focused tests, environment configuration, and public Slack documentation for the new flow.

Why this change was made

Cloud deployments connected to Slack should be able to initiate a private shared support channel without manually coordinating channel creation and invitations. The flow preserves Slack's required acceptance and admin approval steps while keeping manager automations and ordinary task output separate from support conversations.

Impact

Eligible Cloud admins get a one-click support-channel setup path in Settings → Communications. Existing Cloud Slack apps must add the two new scopes and reinstall once; self-hosted deployments request no additional permissions. Cloud operators must configure R_SLACK_CONNECT_SUPPORT_EMAIL, and Slack plan or organization policies may still require approval after the invitation is sent.

[roomote-community]

2 issues outstanding. See task

• packages/slack/src/slack-notifier.ts:445-449 Slack's conversations.inviteShared API requires an email recipient to already be known to the app (for example, through an existing shared channel). A first-time customer has no such connection, so inviting the fixed support address returns user_not_found and this provisioning flow cannot create the initial support channel. Establish a supported bootstrap/preflight or offer a manual fallback rather than presenting this as a one-click setup.
• packages/slack/src/slack-notifier.ts:445-449 Sending external_limited: false gives the external support member authority to invite others, export channel history, and change channel details. The confirmation only warns that outsiders can read messages, so this silently grants broader access to customer support conversations. Use a limited invite unless the extra authority is explicitly required and disclosed.

_{Reviewed ec45f0f}