Slack's interactivity request URL for one agent's app

Called by Slack, not by people: each agent app's interactivity points here, beside its events route (Finalize registers both when an https events address is known, as for the events route). It takes the buttons and the modal of the messages the agent posts in a thread when its session waits on a person: allow or deny a tool permission, answer a question, approve or reject a push request. The form body is read up to 256 KiB (413 above that) and checked as events are: the v0 signature over the raw bytes with the app's signing secret and the timestamp within 300 seconds, else the same 401. The payload field is Slack's JSON. Each press is judged for the Slack user who pressed it, through their linked account, as the same session.approve decision the web makes; a refusal, or a request already answered, is told to that person alone and nothing is answered twice. A request settled here updates its message in place with who settled it and how. A block_actions press answers {"ok": true}; a submitted question modal answers {"response_action": "clear"}, or errors naming the blocks to fix. Rate limited per agent and overall before any database read (429).

Auth: public; no credential. Idempotency-Key: ignored.