(orchestration): Hydrate task context from Slack thread URLs

## Component

API or orchestration

## Describe the feature

Allow task creation (API, CLI, and Slack-origin flows) to accept a **Slack thread permalink** and hydrate the prompt from the full thread: messages, linked files, and bot replies in chronological order, within the existing hydration token budget.

## Use case

Teams often spec work in Slack: discussion, clarifications, and links accumulate in a thread before anyone files a ticket. Submitting only a one-line description drops that context. Background agents work best when the **collaboration artifact** (the thread) is the spec.

## Proposed solution

1. Extend create-task schema with optional `slack_thread_url` (or channel-specific metadata when origin is already Slack).
2. Add hydration fetcher using the installed Slack app token (same credentials as notification dispatcher).
3. Normalize thread to markdown sections; trim oldest non-essential messages first (mirror PR comment trimming).
4. Screen fetched text through existing Guardrails / sanitization paths.
5. CLI: `bgagent submit --slack-thread ...`.

## Other information

- Requires linked Slack workspace (existing setup guide).
- Complements shipped Slack @mention submission; this targets **richer context** for the same channel.
- Consider rate limits and `channel:history` scopes in setup docs.

## Acknowledgements

- [ ] I may be able to implement this feature
- [ ] This might be a breaking change

## Acceptance criteria

- [ ] API and CLI accept optional Slack thread reference; types mirrored in `cli/src/types.ts`.
- [ ] Hydration includes thread body in prompt when provided; title/issue body still preserved.
- [ ] Token budget enforcement matches existing hydration rules.
- [ ] SSRF-safe: only `slack.com` / workspace URLs from configured workspace; reject arbitrary URLs.
- [ ] Tests use mocked Slack API responses in `cdk/test/handlers/shared/context-hydration.test.ts`.

Inizia leggendo le regole di hydration esistenti e il percorso delle credenziali del dispatcher delle notifiche Slack. Poi esamina cli/src/types.ts e cdk/test/handlers/shared/context-hydration.test.ts, incluse le risposte Slack simulate. Il lavoro è completato quando API e CLI accettano un riferimento a un thread, preservano il titolo e il corpo dell'issue, eseguono l'hydration in modo sicuro entro il token budget e rifiutano gli URL non autorizzati.

Scritto dal modello di indicizzazione a partire dal testo della issue.