docs: Slack distributed-app operator runbook (Phase 8 close-out)

[mcheemaa]

Summary

Slack Phase 8 close-out for the agent. Adds docs/slack-cloud-mode.md, the operator-facing companion to the gateway operations runbook in phantom-slack-events. Zero code changes.

The doc covers the in-tenant Phantom side of the distributed-app flow:

• The two transports (socket vs http) and how SLACK_TRANSPORT selects.
• The four metadata gateway endpoints the agent consumes (/v1/identity, /v1/secrets/slack_bot_token, /v1/secrets/slack_gateway_signing_secret, generic /v1/secrets/<name>) with the security invariants each fetcher enforces.
• The bot-token lifecycle from OAuth install through to operator rotation, including the Phase D scope of the RestartTenant RPC.
• ip netns exec curl diagnostic commands for inspecting identity, bot token, and gateway signing secret from the host. Each command shows the safe handling pattern (no plaintext to a pager, shred after read).
• A failure-mode triage table covering token revocation, missing identity subfield, signing-secret mismatch, foreign team_id, and KMS unreachability.

The doc explains existing behavior shipped in src/channels/slack-channel-factory.ts, src/channels/slack-http-receiver.ts, and src/config/. It does NOT introduce new APIs.

Phase 8 review verification (F9)

The Phase 8 close-out review flagged the doc's claim about MetadataSecretFetcher ETag refresh against X-Phantom-Rotation-Id for spot-check verification. Cross-checked src/config/metadata-fetcher.ts:

• METADATA_CACHE_TTL_MS = 60_000 matches "caches each value for 60 seconds".
• headers["If-None-Match"] = '"' + cached.rotationId + '"' matches "uses If-None-Match ETag refresh".
• rotationId = res.headers.get("X-Phantom-Rotation-Id") ?? "0" matches "phantomd's X-Phantom-Rotation-Id header".
• The 304 branch sets cached.fetchedAt = Date.now() matching "a 304 reply extends the cache window".

Doc claim is accurate; no changes required for F9.

Test plan

• bun test 1929 pass / 10 skip / 0 fail (unchanged from main)
• bun run typecheck clean
• bun run lint clean
• No em dashes, emojis, or co-authored-by lines
• All in-repo cross-references resolve (verified getting-started.md, security.md, src/channels/slack-channel-factory.ts, src/config/identity-fetcher.ts, src/config/metadata-fetcher.ts)
• Cross-repo references to phantom-slack-events/docs/operations-slack-gateway.md and ghostwright-site/docs/phantom-signup-walkthrough.md are intentional and resolve when sibling checkouts are present