Draft: Duo Messaging: async flow triggering from Slack via adapter pattern

Summary

Adds the messaging architecture for triggering Duo Agent Platform flows from external messaging services (Slack first, extensible to Teams, WhatsApp, etc.).

See architecture proposal for the full design discussion.

Key components

• WorkspaceProjectService: auto-creates duo-workspace project per namespace
• TriggerFlowService: orchestrator that resolves namespace, project, service account, and triggers the flow
• ResolveServiceAccountService: dedicated duo-messaging-<namespace> SA per namespace
• Adapters::Base + Adapters::Slack: lifecycle hooks (started/completed/failed) with Slack reactions (👀/✅/❌)
• CallbackWorker: subscribes to WorkloadFinishedEvent via EventStore, extracts final agent message from checkpoints, delivers via adapter
• AppMentionedService: rewired from WIP stub to use TriggerFlowService

Design decisions

• Uses duo_default_namespace for namespace resolution (no new settings)
• Callback context stored as JSONB column on Ai::DuoWorkflows::Workflow
• Adapter pattern allows adding new messaging services by implementing ~5 methods
• EventStore subscription (Sidekiq) for async callback, no GraphQL needed

Known gaps

• Cancelled workflows don't trigger callback (workload model has no cancelled state — pre-existing gap)
• No streaming/intermediate checkpoints yet (adapter hook on_checkpoint_created exists but not wired)

Related

• Issue: #590434
• Architecture discussion: gitlab-com/content-sites/handbook!19020 (merged)