Register the slack_assistant foundational flow

What does this merge request do and why?

Warning

This flow is not billed yet. Credits key on the flow reference, and CustomersDot has no entry for slack_assistant/v1. Unmapped keys do not error — they fall through to success — so usage is metered under a key nobody counts.

Decided: register slack_assistant/v1 in CustomersDot mapped to the Duo Developer credit pool, tracked in #628678. Untangling the billing key from the flow reference (#599841) needs cross-team agreement with Fulfillment and is deliberately deferred; a Rails-only attempt was dropped (!254800 (closed)) because it covered only the pre-flight check, leaving a session checked under one key and metered under another.

No code change here when that lands — keying on the flow's own reference is already what the mapping expects. Acceptable while the flag is on for our own group only; #628678 must be live before enabling anywhere else. Blocker on the rollout issue (#628672).

Registers slack_assistant/v1 as a foundational flow, gated by the new slack_duo_api_flow feature flag.

Nothing routes to it here. With the flag on, "GitLab Duo for Slack" appears in a group's GitLab Duo settings and can be enabled; with it off, nothing changes. Routing is !254801, stacked on this.

The entry is API-only:

• coding_environment: none — the CI job skips the clone and setup. First foundational flow to use this. The flow has no tools that would read a repository, so cloning one only delays the answer.
• agent_privileges are READ_ONLY_GITLAB and READ_WRITE_GITLAB. No START_FLOWS: delegation is blocked by the composite identity model rather than by a privilege, so granting it would suggest the capability is one toolset line away. See #628544.
• allow_agent_to_request_user is left at false. It gates the Ask tier of tool governance, and a pending approval has no timeout — an admin "ask" rule would hang the session, because Slack has no approve/deny buttons yet. It flips with those buttons.

The flow config and prompt live in the AI gateway: gitlab-org/modelops/applied-ml/code-suggestions/ai-assist!6867 (merged)

Related to #628428

How to set up and validate locally

1. Check out this branch and restart Rails.

2. Enable the flag. Globally is easiest for a local check:

   Feature.enable(:slack_duo_api_flow)

3. Seed the entry and enable the flow for a group:

   group = Group.find_by_full_path('<your-group>')
   Ai::Catalog::Flows::SeedFoundationalFlowsService.new(organization: group.organization).execute
   enabled = group.selected_foundational_flow_references | ['slack_assistant/v1']
   Ai::CascadeDuoSettingsService.new({ enabled_foundational_flows: enabled },
     current_user: User.find_by_username('root')).cascade_for_group(group)

4. Group → Settings → GitLab Duo shows "GitLab Duo for Slack".

   

5. Disable the flag and confirm it disappears.

There is no end-to-end behaviour to test here by design — that arrives with routing.

---

Stack — merge in this order:

1. !254799 (merged) — registry entry and feature flag.
2. !254801 — routing. The only MR that changes behaviour.

Billing is deliberately out of scope; see the warning above. !254800 (closed) is closed pending that decision.