Summary

This PR hardens Slack Block Kit interactive callback authorization for approval and slash-confirm buttons.

Previously, these callback paths only checked SLACK_ALLOWED_USERS. Deployments using Slack adapter config such as extra.allow_from for normal inbound authorization could have approval/slash-confirm button clicks ignore that configured allowlist when SLACK_ALLOWED_USERS was unset.

This change adds a shared Slack interactive authorization helper that:

• preserves SLACK_ALLOWED_USERS precedence and wildcard support
• falls back to config.extra["allow_from"] when the env allowlist is unset
• preserves existing permissive behavior when no allowlist is configured

Why

Slack button callbacks bypass the normal gateway message authorization flow, so they need to enforce the same configured user allowlist locally. This keeps approval and slash-confirm actions aligned with the adapter’s existing auth configuration.

Tests

scripts/run_tests.sh tests/gateway/test_slack_approval_buttons.py -q

Result: passed, exit code 0.

git diff --check also passed.