feat: add Slack assistant.search.context workspace search tool (TKAI-72)

[yourbuddyconner]

Summary

Implements the slack.search_context action for workspace-wide semantic + keyword search via Slack's assistant.search.context API (Phase 1: Bot Token + Public Search).

Changes

Slack App Manifest (packages/plugin-slack/slack-app-manifest.json)

• Added bot scopes: search:read.public, search:read.files, search:read.users

action_token Propagation (4 files across worker + DO)

• Extract action_token from Slack event payloads (slack-events.ts)
• Thread it through dispatchOrchestratorPrompt → DO /prompt endpoint → session-agent
• Store as ephemeral in-memory property on session DO (lastSlackActionToken)
• Inject into Slack credentials alongside owner_slack_user_id in session-tools.ts

New Action: slack.search_context (packages/plugin-slack/src/actions/actions.ts)

• Full parameter support: query, content_types, channel_types, limit, cursor, sort, sort_dir, before/after timestamps, include_context_messages
• Entity resolution (user display names, channel names, mention replacement) using existing cache system
• Clear error when action_token is unavailable, directing fallback to slack.read_history

Skill Doc (packages/plugin-slack/skills/slack-tools.md)

• Added "Workspace Search" section with usage guidance and limitation notes

Architecture Notes

• action_token is short-lived and per-interaction — stored ephemerally on the DO, not persisted to DB
• The token flows: Slack event → slack-events.ts → orchestrator.ts → session-agent DO → session-tools.ts → credentials → action
• Entity resolution leverages the existing resolveAndEnrichMessages + module-level caches

Testing Notes

• Existing slack-events tests pass (10/10)
• action_token extraction handles both event.action_token and body.action_token with fallback
• The search_context action gracefully errors when action_token is unavailable (non-assistant-thread invocations)
• Requires Slack App reinstallation to pick up new bot scopes
• Needs live verification against actual assistant.search.context API responses to confirm response shape

Limitations (Phase 1)

• Only works when user interacts via Slack assistant thread (action_token requirement)
• Bot token search scoped to public channels by default (user token path deferred to Phase 2)
• action_token extraction positions (event.action_token vs body.action_token) need verification against live Slack payloads

Closes TKAI-72