Slack app manifest: reconcile drift both ways (live app vs. checked-in reference)

Two-directional manifest drift, found while rolling out #1294 (email-based AccessResolver) to the live staging bot.

1. Live app is missing things the checked-in reference already has

sdk/typescript/examples/slack-bot/slack-app-manifest.json already includes:

• groups:history bot scope (private-channel history)
• message.groups bot event (private-channel messages)
• agent_session_stopped bot event (Slack's native stop button - without this, agents.sessions.setStatus returns missing_agent_session_stopped_event_subscription, confirmed seen in real staging logs)

The live staging app's manifest had none of these three before this rollout. Deferred deliberately rather than bundled into the urgent #1294 rollout - add them to the live app's manifest via Settings → App Manifest, reinstall, done.

2. The checked-in reference is missing what #1294 needs

Going the other direction: slack-app-manifest.json's oauth_config.scopes.bot does NOT include users:read / users:read.email - the two scopes #1294's EmailAllowlistResolver requires to resolve a sender's verified email via users.info. The README's manual-setup path already documents these as required (added in #1294), but the "fast path" (paste the reference manifest) would silently produce a broken deployment, since the reference file itself was never updated to match.

Fix

• Add groups:history, message.groups, agent_session_stopped to the live staging Slack app (Settings → App Manifest, then reinstall).
• Add users:read and users:read.email to slack-app-manifest.json's oauth_config.scopes.bot, so the checked-in reference and the "fast path" instructions actually match what the code requires.