feat(slackbotv2): start workflows from Slack shortcuts

[decofe]

Summary

• accept signed Slack message_action shortcuts and start idempotent durable workflow runs for workflow.<name> callbacks
• pass only the invoking Slack user's identity metadata to API-rs, resolve the matching requester principal server-side, and bind it to the workflow sandbox proxy
• require the actor's Slack team to match the app's home team, preventing Slack Connect users from borrowing home-workspace OAuth credentials
• persist only the opaque requester principal ID in the durable task; reject credential-shaped requester fields and omit Slack response/trigger URLs
• inherit the requester principal for child workflows while scheduled and requester-less runs remain unchanged

Validation

• bun test in services/slackbotv2 (255 passed, 1 skipped)
• focused centaur-iron-control requester tests (2 passed)
• focused centaur-workflows tests (19 passed)
• cargo +nightly fmt --all -- --check
• cargo +nightly clippy -p centaur-iron-control -p centaur-workflows -p centaur-api-server --all-targets -- -D warnings
• bun run check:types remains blocked by three pre-existing fetch.preconnect typing errors in test/slack-user.test.ts

Prompted by: @vinaykantharia