fix(security): require signed Slack webhooks

[bokelley]

Summary

• fail closed when the AAO Slack signing secret is missing, empty, or whitespace-only
• require signature verification for slash commands, events, and URL verification challenges before any handler runs
• verify exact captured request bytes and remove the duplicate fail-open verifier path
• add production-router regressions for unsigned, stale, invalid, tampered, and valid signed requests

Root cause

The shared Slack verifier called next() when SLACK_SIGNING_SECRET was absent, while the events route conditionally skipped verification entirely. That allowed public forged commands and events to reach handlers, including identity and prospect-processing side effects.

Impact

Deployments without a configured AAO Slack signing secret now return 503 from those webhook routes instead of accepting unsigned traffic. Correctly configured Slack requests continue to work, including signed URL verification challenges.

Validation

• security expert review: clean
• testing expert review: clean
• focused Slack suites: 61/61 passed
• TypeScript no-emit: passed
• Semgrep: 0 findings across 210 rules on the changed runtime files
• diff/package/lock/dist scope checks: passed

No changeset is required because this is an operational server security fix with no protocol or package API change.