Slack bot: manual permission approval flow

Summary

Add a manual permission approval flow to the Slack bot so a run can pause for
an authorized person's decision instead of automatically allowing every ask.

The current reference implementation passes
onPermissionAsk: () => "allow_once". This is appropriate for its trusted
development baseline, but it does not provide a human approval boundary for a
deployed bot.

Scope

• Represent a pending permission ask with Slack's suspended status and Block
  Kit controls.
• Deliver the request only to the authorized person who initiated the run.
• Support allow-once and deny decisions. Include allow-always only if the
  server and SDK can preserve its existing authority semantics.
• Correlate every interaction with the exact session, run, and ask.
• Reject stale, duplicate, unauthorized, and post-terminal interactions.
• Resume the run after an accepted decision and clear the pending Slack UI
  when the run terminates or is canceled.
• Cover the interaction and race behavior with offline tests.

Completion criteria

• A permission ask never appears as an actionable control to a whole channel.
• One accepted decision resolves the exact pending ask.
• A stale or unauthorized interaction cannot affect another run.
• The bot can select manual approval without retaining the unconditional
  auto-approval callback.

References

• #883 and sdk/typescript/examples/slack-bot/DESIGN.md.
• The Slack bot integration roadmap parent.

Fully or partially written by an AI agent.

Start with sdk/typescript/examples/slack-bot/DESIGN.md and the implementation referenced by #883; inspect how the current onPermissionAsk callback selects allow_once. Define the offline interaction and race tests around the Slack suspended status and Block Kit controls. Done means only the initiating authorized user can resolve the exact pending ask, stale or duplicate actions are rejected, and terminal runs clear the UI.