Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@docs/manage-sandboxes/messaging-channels.md`:
- Around line 66-67: Update the Slack row in the channel requirements table to
reflect the new SLACK_ALLOWED_USERS setting: replace the current "None"/optional
note with a brief description like "SLACK_ALLOWED_USERS — comma-separated Slack
member IDs to authorize users for DMs and for channel `@mention` events (channel
messages still require explicit bot mention)"; ensure the wording matches the
paragraph that introduced SLACK_ALLOWED_USERS so the table and the explanatory
text are consistent.

In `@test/e2e/lib/fake-slack-api.cjs`:
- Around line 104-129: The handler for pathname "/api/chat.postMessage"
currently sets the HTTP status based on authAccepted (using
res.writeHead(authAccepted ? 200 : 401)); change it to always return HTTP 200
and keep the existing JSON error payload when authAccepted is false so responses
match Slack (ok: false with error "bad_auth"); update the res.writeHead call to
use 200 unconditionally and leave the JSON body logic that branches on
authAccepted unchanged (refer to variables pathname, authAccepted, res.writeHead
and the JSON branch that produces ok: true vs ok: false).

In `@test/e2e/test-messaging-providers.sh`:
- Line 127: The test currently forces a default when SLACK_ALLOWED_USERS is
empty by using the ":-" expansion in the SLACK_IDS assignment; change it to the
"–" (single dash) expansion so explicit empty SLACK_ALLOWED_USERS="" is honored
(i.e., update the SLACK_IDS assignment that references SLACK_ALLOWED_USERS to
use the `${SLACK_ALLOWED_USERS-...}` form instead of
`${SLACK_ALLOWED_USERS:-...}`).
- Line 220: The test currently logs raw Slack user IDs via the info call
referencing SLACK_IDS; stop exposing these identifiers by changing the info
invocation to log only non-sensitive metadata (e.g., the number of entries or a
redacted form). Update the usage of SLACK_IDS in the info call so it either logs
"Slack allowed users: N" (where N is the count) or maps each ID to a masked
representation (e.g., replace all but last 4 chars or produce a deterministic
hash) before passing to info; modify the code that builds the message where
SLACK_IDS is referenced to perform the redaction so other references remain
unchanged.
- Around line 901-935: The test currently treats an enabled Slack wildcard
channel with requireMention=true but an empty users list as a skip; change the
logic so that when sl_channel_users is empty yet the wildcard config is present
and enabled (i.e., the code path that produced sl_channel_users), the test fails
instead of skipping. Concretely, update the conditional around
sl_channel_users/skip: if sl_channel_users is empty while the wildcard config is
enabled and requireMention is true (use the existing sl_channel_users variable
produced by the Python extractor and the expected_slack_ids/SLACK_IDS
comparison), call fail with a descriptive message (e.g., "M11h: Slack wildcard
channel users is empty but should contain IDs") instead of executing the skip
branch. Ensure the check runs before treating missing or unset configs as skip.