Slack integration: scope the bot to the conversation it needs

Workspace messages, files, users, and administrative data require different permissions and retention.

• Request minimum OAuth scopes.
• Use team, channel, thread, user, and message IDs.
• Verify signed requests and process retries idempotently.
• Respect edits, deletions, thread context, and visibility.
• Keep message text out of routine logs.

Test shared channels, removed apps, renamed users, rate limits, duplicate events, and expired interactivity. Do not post automatically from untrusted content without confirmation.