feat(crosscheck): resume central Slack review lane

[ruby-dlee]

Summary

• expose Crosscheck through a centrally operated outbound-only Slack Socket Mode listener
• share the existing four-lane FIFO while enforcing allowlists, durable dedupe, visible saturation, and per-engineer daily caps
• bind agent authorship to signed pre-launch worktree/model/account evidence and the exact reviewed PR head
• preserve the direct CLI and fail closed on missing provenance, moved heads, or infrastructure failure
• add central Keychain/launchd operations and update R10 from deferred to resumed

Verification

• bash tests/fm-crosscheck-slack.test.sh (28 units)
• bash tests/fm-spawn-dispatch-profile.test.sh (21 units)
• focused provenance, worktree-rebinding, redelivery, service, and four-worker regressions
• Python compilation, shell syntax, diff hygiene, and pinned ShellCheck 0.11.0
• earlier full no-mistakes test and lint phases passed before the final provenance hardening; CI is the current full-suite gate

Activation

Code and runbook are deployment-ready. Live Slack activation requires the named coordinator-only inputs documented in docs/crosscheck-slack.md; no credential values belong in this PR.