feat(users): verify mention targets directly

[dwaxe]

Addresses the ID and email cases in #129.

Problem

A valid-looking Slack ID may not identify an active human, and resolving targets one at a time can produce a partial mention batch. The previous safe resolver avoided that ambiguity by scanning every users.list page, but that turns a small identity check into 53-54 paginated requests in a large Enterprise Grid workspace.

In a trailing-30-day local command-history audit, 16 of 29 user resolve invocations (55%) ended in rate limiting. The successful scans consistently traversed 53-54 directory pages.

Fix

Add agent-slack user resolve for batches of at most 20 canonical IDs and emails. It:

• binds the selected workspace to the canonical URL returned by auth.test;
• deduplicates identities before issuing direct requests;
• verifies IDs with users.info;
• resolves standard-token emails with users.lookupByEmail;
• resolves browser-session emails with one bounded Slack edge search, requires exactly one case-insensitive profile-email match, then verifies that ID with users.info;
• rejects deleted, bot, invited, suspended, forgotten, and profile-only accounts; and
• emits mentions only when the complete batch is safe.

Names and handles remain rejected. This command never calls users.list.

Evidence

• Regression coverage proves three unique targets make exactly three direct requests and zero users.list calls; duplicate emails and IDs do not add requests; oversized batches are rejected before Slack access.
• Browser coverage proves a search result is accepted only after exact-email matching and a follow-up users.info verification, and malformed edge/workspace IDs fail before credentials are sent.
• A live Meraki Engineering browser-session run resolved the authenticated user's actual profile email with safe_to_mention: true using exactly two requests (bounded search plus users.info), with no directory pagination or rate-limit response.
• Fresh-context review findings were addressed: authenticated workspace attribution, is_profile_only_user, batch bounds, and deduplication.
• Full branch checks pass: 420 tests, typecheck, build, and formatting; lint reports 14 existing warnings and zero errors.

This changes the rate-limit exposure from O(directory pages) to O(unique requested identities), capped at 20 identities. Slack applies rate limits per method/workspace/app, so removing the 53-54-page users.list scan is the material fix for the observed pattern: https://docs.slack.dev/apis/web-api/rate-limits/