[Feat] Show when Slack app upgrades are required

[roomote-roomote]

​Opened on behalf of @mrubens. Follow up by mentioning @roomote-roomote, in the web UI, or in Slack.

What changed

• Added an explicit Slack manifest version that can be bumped independently of Roomote releases.
• Recorded configured manifest provenance after Slack confirms create or update operations, and recorded the installed version only after no-permission updates or a matching signed OAuth installation callback.
• Added an upgrade indicator to Communications settings and kept permission-changing upgrades pending until the existing Slack reinstall flow completes.
• Documented legacy installation behavior and the steps that clear the indicator.

Why this change was made

Slack app capabilities evolve independently from product releases. Persisted version evidence lets Roomote tell admins when their installed app needs a manifest update without guessing from Slack APIs or treating credential validation as a successful upgrade.

Impact

Existing installations start with an unknown version and show Upgrade available until a manifest export confirms they are current or the update and required reinstall complete. Newly generated apps and confirmed updates record their version automatically; future manifest requirement changes only need to bump the shared Slack manifest version constant.

Screenshots

[roomote-community]

1 issue outstanding. See task

• Keep Slack manifest metadata out of task sandboxes (packages/types/src/control-plane-env-vars.ts:173-175).

_{Reviewed f814a0b}

[roomote-community]

ROOMOTE_MANAGED_ENV_VAR_NAMES is only enforced by the generic editor. Task startup redacts persisted deployment variables exclusively through CONTROL_PLANE_ENV_VAR_NAMES (fetchEnvVars / fetchResolvedRuntimeEnvVars), so both newly persisted R_SLACK_MANIFEST_* values are injected into every task sandbox. That contradicts this block's “task sandboxes never receive them” contract and leaks deployment-specific Slack metadata to untrusted tasks. Add these names to the control-plane/redaction set as well, with a regression test.