fix(security): enforce Slack knowledge ACLs

[bokelley]

Summary

• remove Slack history tools from shared/global Addie clients and install them only with an explicit request-scoped caller identity
• make missing, unlinked, and permission-error contexts public-only instead of unrestricted
• enforce private-channel allowlists in SQL for both search and channel activity before ordering, limiting, and response aggregation

Security impact

Authenticated web and voice callers previously inherited Slack knowledge handlers created without Slack identity. In that state, undefined disabled private-channel filtering, and channel activity had no row-level ACL at all. This could expose private working-group messages, participants, and permalinks.

The new discriminated access scope binds linked callers to their Slack allowlist and treats every absent/error context as public-only. Slack, legacy, web, and Tavus paths now install atomic request-scoped tool definitions and handlers.

Validation

• 4,935 server unit tests passed; 30 skipped
• 1,025 repository unit tests passed
• focused Slack ACL/routing tests passed
• TypeScript passed
• git diff --check passed
• changeset protocol-scope check passed
• independent security review: CLEAN

Follow-up

Private/public classification currently depends on retaining the indexed channel's working_groups.slack_channel_id mapping. Persisting privacy-at-index or cleaning stale rows during channel remaps is separate lifecycle hardening and is not introduced by this change.