Fix Slack bot-ID mentions without racing app mentions

[time-attack]

Summary

• recognize Slack's bot-ID mention form alongside the bot-user-ID form in shared mention parsing, stripping, mirroring, and history rendering
• route validated human-authored bot-ID-only messages through the existing addressed-turn path without racing normal app_mention delivery
• establish thread stake only after accepted fallback intake, keeping rejected/failed/peer-bot cases fail-closed
• add rate-limited acceptance diagnostics and preserve existing local/durable dedupe keys

Fixes #630.

Test plan

• node --experimental-test-module-mocks --test --test-concurrency=2 test/slack-*.test.ts test/admin-slack-mirror.test.ts test/external-slack-participants.test.ts test/surface-cache*.test.ts test/loop-source-send.test.ts test/loop-ledger.test.ts (701 passed)
• npm run typecheck
• targeted ESLint and Oxlint on all 12 changed files
• targeted Prettier check on all 12 changed files
• git diff --cached --check

Live Slack client/event fan-out and real PostgreSQL multi-process replay remain follow-up validation; the added suites cover both event orders, retries, failed author classification, peer-bot negatives, concurrent intake, and accepted-versus-rejected thread stake.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}