incidents: fire a fresh Slack 'open' on the first Critical escalation

[passcod]

🤖

Building on the new "critical opens immediately" semantics: when an incident has already been opened at a lower severity and a Critical contributor joins after the original Slack incident_open has shipped, we now enqueue a fresh incident_open row as the escalation signal. The drainer ships it at Critical timing (no holding window).

Gated on a new incidents.escalated_at column so this only fires the first time per incident — subsequent Critical joins are silent, otherwise a flapping check could re-page operators repeatedly.

The two cases when a Critical joins an existing incident now read as:

• Original open is still pending in the outbox → accelerate it (existing behaviour). No second message; the open hasn't been seen yet.
• Original open has already shipped, escalated_at IS NULL → stamp escalated_at and enqueue a fresh open. The message text uses the existing "incident opened" template (for now, as if the incident had opened for the first time).

The previous test asserting "no Slack noise after delivered open" is replaced with the inverse-and-then-some: original + escalation rows, escalation deliver_after ~now, escalated_at recorded; plus a new test that a second Critical join leaves the row count at two.