feat(relay): centralize binding authority

[zikolach]

Summary

• add shared binding-authority outcomes, resolvers, snapshot loading, and stable destination keys
• migrate Telegram, Discord, Slack, broker, lifecycle, and requester-file paths to fail closed on revoked/moved/paused/unavailable state
• add authority matrix, corrupt-state, requester-file, broker, and hot-path guard tests
• mark centralize-binding-authority-resolution OpenSpec tasks complete

Validation

• npm run typecheck
• npm test
• openspec validate centralize-binding-authority-resolution --strict

[Copilot]

Pull request overview

This PR introduces a centralized binding-authority module that classifies messenger binding state into a small set of outcomes (active, paused, revoked, moved, missing, state-unavailable) and migrates all relay delivery edges (Telegram/Discord/Slack adapters, broker process, in-process runtime, lifecycle, requester-file delivery) to fail closed when state is unreadable instead of silently treating load errors as an empty store. It also introduces stable destination keys for timer/progress bookkeeping so deferred work cleans up correctly even if a route's binding mutates.

Changes:

• Adds extensions/relay/core/binding-authority.ts with shared resolver/key/diagnostic helpers and loadBindingAuthoritySnapshot on TunnelStateStore that distinguishes missing vs corrupt state.
• Migrates Telegram/Discord/Slack runtimes, broker process.js/tunnel-runtime.ts, requester-file delivery, lifecycle, and extension-runtime status/send paths to authority snapshots and stable destination keys.
• Adds new test suites (binding-authority, state-store-hot-paths, broker corrupt-state, runtime corrupt-state suppression, requester-file authority-denied) and marks the OpenSpec tasks complete.

Reviewed changes

Copilot reviewed 18 out of 18 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
extensions/relay/core/binding-authority.ts	New shared authority resolver, outcome types, destination keys, diagnostics
extensions/relay/core/index.ts	Re-exports binding-authority module
extensions/relay/core/requester-file-delivery.ts	Adds optional authoritySnapshot and authority-denied failure code before reading/uploading
extensions/relay/state/tunnel-store.ts	Adds loadBindingAuthoritySnapshot, fail-closed semantics, sync-helper warnings
extensions/relay/runtime/extension-runtime.ts	Status/send-file/lifecycle paths use snapshots and outcomes
extensions/relay/adapters/telegram/runtime.ts	Telegram delivery, activity/progress timers, session listings, register/auth flows migrated to authority + destination keys
extensions/relay/adapters/discord/runtime.ts	Discord active-binding, typing refresh, active-selection paths use snapshots
extensions/relay/adapters/slack/runtime.ts	Slack active-binding, find-binding, progress keying use snapshots and shared keys
extensions/relay/broker/tunnel-runtime.ts	Passes authority snapshot into requester-file delivery
extensions/relay/broker/process.js	New loadStateSnapshot, snapshot-based binding resolution, userId-aware activity/progress keys
docs/adapters.md	Updates binding-authority guidance
openspec/changes/.../tasks.md	Marks all tasks complete
tests/* and tests/relay/*	Adds authority matrix, hot-path guard, corrupt-state, requester-file, broker corrupt-state tests