Add attachments: TagAttachment, Slack file normalization, fileLookup

[TheGreatAxios]

Summary

• TagAttachment (new in @corbits/tag-core) rides on PriorTurn.attachments and TagEvent.attachments. The platform package normalizes whatever file metadata it has onto this shape; it never downloads — url, when present, is a platform-specific download URL requiring platform auth. TagEvent also gains messageId (adjacent addition riding the same toEvent() touch, not itself attachment-specific — called out since it wasn't separately enumerated when this work was scoped).
• tag-slack: wire.ts normalizes Chat SDK's message.attachments, then recovers Slack file ids and stronger metadata (name/mimetype/url) from the raw Slack event's message.files by URL → name → index match (resolveRawFile/toAttachment/resolveAttachmentId). New slack-files.ts adds createSlackFileLookup — an authenticated files.info client with host-validated URLs (rejects anything not *.slack.com/*.slack-files.com before ever sending the bot token) and a small dedup cache — for enriching id-only file events past what the Chat SDK attachment already carries.
• mountSlackTag auto-wires fileLookup whenever a bot token is present, mirroring the existing userLookup auto-wire (shouldAutoWireFileLookup, same "explicit undefined disables it" contract).
• Adds a real arktype dependency to tag-slack/package.json for the untyped-JSON validation both slack-files.ts and the raw-file recovery use. arktype@2.2.3 and its transitive deps (@ark/schema, @ark/util, arkregex) were already resolved in this repo's lockfile (pulled in via @intx/db/@intx/types in tag-interchange) at the exact same version, so bun.lock only needed the new dependency edge from tag-slack, not a new package resolution.

Test plan

• CI: bun run typecheck && bun run test
• packages/tag-slack/src/wire.test.ts: new wireBot attachments suite — Chat SDK attachments merged with raw Slack file metadata, synthetic ids when raw files are absent, raw files replacing placeholder metadata by index, fileLookup enrichment of an id-only event, no-attachments leaves the field absent, tolerating an opaque raw payload, prior-turn attachments, and messageId presence/absence.
• packages/tag-slack/src/slack-files.test.ts: new — createSlackFileFetcher/createSlackFileLookup coverage (auth header, URL host validation rejecting non-Slack origins, files.info success/not-found/error/malformed-response handling, result caching).
• packages/tag-slack/src/index.test.ts: new shouldAutoWireFileLookup suite mirroring the existing shouldAutoWireUserLookup coverage.
• Not run locally (sandboxed dev machine); tests will run in this repo's CI.