(orchestration): Hydrate task context from Slack thread URLs

## Component

API or orchestration

## Describe the feature

Allow task creation (API, CLI, and Slack-origin flows) to accept a **Slack thread permalink** and hydrate the prompt from the full thread: messages, linked files, and bot replies in chronological order, within the existing hydration token budget.

## Use case

Teams often spec work in Slack: discussion, clarifications, and links accumulate in a thread before anyone files a ticket. Submitting only a one-line description drops that context. Background agents work best when the **collaboration artifact** (the thread) is the spec.

## Proposed solution

1. Extend create-task schema with optional `slack_thread_url` (or channel-specific metadata when origin is already Slack).
2. Add hydration fetcher using the installed Slack app token (same credentials as notification dispatcher).
3. Normalize thread to markdown sections; trim oldest non-essential messages first (mirror PR comment trimming).
4. Screen fetched text through existing Guardrails / sanitization paths.
5. CLI: `bgagent submit --slack-thread ...`.

## Other information

- Requires linked Slack workspace (existing setup guide).
- Complements shipped Slack @mention submission; this targets **richer context** for the same channel.
- Consider rate limits and `channel:history` scopes in setup docs.

## Acknowledgements

- [ ] I may be able to implement this feature
- [ ] This might be a breaking change

## Acceptance criteria

- [ ] API and CLI accept optional Slack thread reference; types mirrored in `cli/src/types.ts`.
- [ ] Hydration includes thread body in prompt when provided; title/issue body still preserved.
- [ ] Token budget enforcement matches existing hydration rules.
- [ ] SSRF-safe: only `slack.com` / workspace URLs from configured workspace; reject arbitrary URLs.
- [ ] Tests use mocked Slack API responses in `cdk/test/handlers/shared/context-hydration.test.ts`.

Start by reading the existing hydration rules and the Slack notification dispatcher credential path. Then inspect cli/src/types.ts and cdk/test/handlers/shared/context-hydration.test.ts, including the mocked Slack responses. Done means API and CLI accept a thread reference, preserve the title and issue body, hydrate safely within the token budget, and reject unauthorized URLs.

Written by the indexing model from the issue text.