[Sprint 1 | API | d3v07] Slack routing and typed Action persistence

[d3v07]

Context

Routing is the demo payoff: a detected policy violation should create concrete actions, fire a real Slack webhook, and persist typed records for the mocked destinations. This issue owns only Slack rendering/delivery and typed Action persistence.

Acceptance Criteria

• Render Slack Block Kit message for a ChangeReport with vendor, policy, severity, impact, citation, and action links
• Deliver Slack messages through SLACK_WEBHOOK_URL when route is slack:@vendorOwner or demo channel route
• Resolve slack:@vendorOwner through vendor.ownerId -> user.slackUserId
• Persist typed Action rows for Slack, Jira, Email, and Calendar routes
• Track delivery status, external ids, and provider errors without throwing away the ChangeReport
• Emit action.delivered SSE event when a route completes or fails
• Tests cover Slack rendering, route resolution, webhook success, webhook failure, and typed mocked actions

Files to Touch

• apps/api/src/agent/router.ts
• apps/api/src/providers/slack.ts
• apps/api/src/db/actions.ts
• apps/api/src/stream/events.ts
• packages/shared/src/types.ts
• packages/shared/src/schemas.ts
• tests/api/slack.test.ts
• tests/api/actions.test.ts

Prompt

/plan
Implement the Redline Slack routing and typed Action persistence slice from the handoff. Build Slack Block Kit rendering, webhook delivery, `slack:@vendorOwner` resolution, typed Action rows for Slack/Jira/Email/Calendar, delivery status tracking, and `action.delivered` SSE events. This branch must stand alone from other issue branches.

Test Plan

1. Run Slack provider tests with mocked webhook responses
2. Run action persistence tests for Slack, Jira, Email, and Calendar payloads
3. Verify slack:@vendorOwner resolves from seeded vendor and user data
4. Verify provider failure persists a failed Action instead of crashing the run
5. Verify action.delivered event is emitted for success and failure

Redline Handoff Adherence

• Routing rules from handoff/Product Decisions.html
• External Slack contract from handoff/API.html
• Action shape from handoff/Data Model.html
• This issue has no dependency on Add Vendor, Stripe, evidence brief, lifecycle routes, or the SSE endpoint branch beyond using the event contract locally

Per-Issue PR Workflow (REQUIRED)

1. Branch from main: d3v07/slack-routing-actions
2. Implement without waiting on any other issue branch
3. PR to main: Closes this issue
4. Review pass for route resolution, typed payloads, and provider failure behavior
5. Address comments
6. Leave final merge to main for the owner

Definition of Done

• Branch pushed: d3v07/slack-routing-actions
• PR opened against main
• Slack and Action tests pass
• Provider failure behavior verified
• No secrets or local env values committed