Release Bot (4.5): Slack app registration, scopes, and Vault credential provisioning

[blarghmatey]

Description/Context

Sub-issue of ol-infrastructure#4485 — Slack Release Bot.

Configure the Slack application, register all slash commands and enable Socket Mode, and provision the required credentials in Vault so the release bot K8s deployment can mount them as secrets.

This is primarily configuration and credential management work, not code. It must be completed before the release bot can be tested end-to-end in any environment.

Plan/Design

Slack App configuration (via api.slack.com/apps):

1. Enable Socket Mode — generates the xapp-... app-level token with connections:write scope
2. Register slash commands:
   • /release, /release-notes, /release-status, /promote, /publish, /hotfix
   • Request URL: leave blank (Socket Mode; Slack delivers via WebSocket, not HTTP)
3. Add bot token OAuth scopes: chat:write, commands, channels:read, users:read
4. Remove legacy interactive components callback URL (no longer needed with Socket Mode)
5. Reinstall app to workspace to generate the updated xoxb-... bot token

Vault secrets (path TBD — follow ol-infrastructure Vault conventions):

• SLACK_BOT_TOKEN — xoxb-... OAuth bot token
• SLACK_APP_TOKEN — xapp-... app-level token
• CONCOURSE_URL — Concourse API base URL
• CONCOURSE_TOKEN — Concourse local service account token (see open question Adding the remaining VPCs to the network project #12 in release plan: confirm whether local accounts are available or if webhook token approach is needed)
• GITHUB_TOKEN — GitHub PAT or GitHub App token with repo and issues:write scopes

Pulumi secret mounting (in __main__.py from sub-issue 4.1):

• Read secrets from Vault via the existing ol-infrastructure Vault provider pattern
• Mount as K8s Secret and reference in Deployment envFrom

Acceptance criteria:

• Slack app is installed in the mitodl workspace with all required scopes
• All slash commands respond in Slack (even if handlers return placeholder responses initially)
• Vault secrets are provisioned in CI, QA, and Production paths
• K8s deployment in CI environment successfully authenticates to Slack, Concourse, and GitHub on startup