fix(slack): pasted GitHub URL in a mention resolves to the wrong repo (github.com/<owner>)

## Summary

Mentioning the Slack bot with a pasted GitHub URL extracts the wrong repo. The
mention repo pattern treats `github.com` as the owner segment, so
`https://github.com/aws-samples/sample-interview-assistant-serverless/issues/24`
resolves to the repo `github.com/aws-samples` and the task is rejected with
`Repository 'github.com/aws-samples' is not onboarded`.

Pasting a URL is the natural thing to do in Slack — Slack linkifies and unfurls
it automatically — so this affects effectively every new user.

## Reproduction

In a channel where the bot is installed:

```
@bot fix https://github.com/aws-samples/sample-interview-assistant-serverless/issues/24
```

Observed: :x: reaction and reply
`Failed to create task: Repository 'github.com/aws-samples' is not onboarded. Register it with a Blueprint before submitting tasks.`

Expected: task created against `aws-samples/sample-interview-assistant-serverless`, issue 24.

## Root cause

`cdk/src/handlers/slack-events.ts:185`:

```ts
const repoPattern = /\b([a-zA-Z0-9_.-]+\/[a-zA-Z0-9_.-]+(?:#\d+)?)\b/;
```

`.` is inside the owner character class, so `github.com` is a valid owner match
and the pattern matches the leftmost `/` pair.

Verified against the exact inbound text (after `<@Uxxx>` stripping):

| Input | Extracted |
|---|---|
| `fix ` | `github.com/aws-samples` |
| `fix https://github.com/aws-samples/sample-interview-assistant-serverless/issues/24` | `github.com/aws-samples` |
| `fix aws-samples/sample-interview-assistant-serverless#24` | `aws-samples/sample-interview-assistant-serverless#24` |

Two aggravating factors:

1. The bad value passes `isValidRepo` (`cdk/src/handlers/shared/validation.ts:45`),
which also permits dots in the owner segment — so it reaches the onboarding
check rather than failing validation with a clearer message.
2. A URL match pre-empts the channel default repo
(`bgagent slack onboard-channel`), because `handleSubmit` only falls back to
the default when no repo token matched
(`cdk/src/handlers/slack-command-processor.ts:207-217`). So an onboarded
channel does not work around it.

## Proposed fix

In `slack-events.ts`, before the bare `owner/repo` match:

1. Normalize GitHub URLs to `owner/repo#N` — recognize
`https://github.com//` optionally followed by
`/issues/` or `/pull/`, and strip Slack's `<...>` / `` wrapper.
2. Require the matched URL host to be `github.com` / `www.github.com`.
3. Exclude host-like owners from the bare pattern so a stray `example.com/foo`
cannot be mistaken for a repo.

## Acceptance criteria

- [ ] Pasted issue URL, PR URL, and bare repo URL all resolve to `owner/repo`, with the issue/PR number carried through
- [ ] Slack's `` and `` wrappers handled
- [ ] Non-GitHub URLs do not produce a repo match; the channel default applies instead
- [ ] Existing `owner/repo#N` short form keeps working
- [ ] Unit tests in `cdk/test/` cover each row of the table above

Start with the repo extraction logic at cdk/src/handlers/slack-events.ts:185, then inspect validation.ts:45 and the fallback flow in cdk/src/handlers/slack-command-processor.ts:207-217. Run or extend the unit tests in cdk/test/ for the listed URL and short-form inputs. Done means GitHub issue, pull-request, bare-repository, Slack-wrapped, non-GitHub, and channel-default cases resolve as specified.

Written by the indexing model from the issue text.