chore: add ClaudeBox Foundation CI bot smoke

[AztecBot]

Summary

• add a PR-triggered ClaudeBox CI bot smoke workflow; no workflow_dispatch path
• gate it behind the ci-claudebox-bot-smoke label so it is opt-in and does not run on every PR
• verify AZTEC_FOUNDATION_CI_SLACK_BOT_TOKEN with Slack auth.test; optionally post a hello message only on the label event when AZTEC_FOUNDATION_CI_SLACK_CHANNEL_ID is configured

Validation

• parsed .github/workflows/claudebox-ci-bot-smoke.yml with PyYAML
• bash syntax-checked the workflow run block

Notes

This expects the repo secret AZTEC_FOUNDATION_CI_SLACK_BOT_TOKEN. Posting is disabled unless the repo variable AZTEC_FOUNDATION_CI_SLACK_CHANNEL_ID is set.

[AztecBot]

CI-bot smoke status after the PR-CI/labeled proof:

• The workflow is correctly running from pull_request/labeled, not workflow_dispatch.
• AZTEC_FOUNDATION_CI_SLACK_BOT_TOKEN is present in aztec-packages and auth.test succeeds as Slack user U0B4R8117GT.
• After setting repo variable AZTEC_FOUNDATION_CI_SLACK_CHANNEL_ID to the Foundation #ai-claudebox channel, the hello post fails with Slack not_in_channel.

Root cause: the live Foundation CI Slack app has chat:write and channels:read, but it is not in the target channel and does not yet have the repo-owned CI manifest installed. Claudebox PR #458 is merged and documents/adds claudebox-server/slack-ci-app-manifest.json with chat:write.public, so the intended fix is to update/reinstall the Foundation CI app from that manifest, then remove/re-add the ci-claudebox-bot-smoke label to rerun this PR-CI smoke.

[AztecBot]

Follow-up after claudebox #459:

The deployed doctor now treats all three secondary Foundation bots as first-class install targets. Current live check from claudebox main e5753796 still shows this is a Slack app approval/reinstall blocker, not a repo or host secret blocker:

• Foundation / publicbox / AI-read / Foundation CI tokens all authenticate.
• Foundation / publicbox / AI-read / Foundation CI Socket Mode app tokens all authenticate.
• AI-read MCP can read #ai-claudebox history from claudebox slackbot.
• Live scopes still missing:
  • Foundation: channels:write.invites, channels:manage
  • Publicbox: channels:join
  • AI-read: channels:join, channels:read
  • Foundation CI: channels:join

Next action is Slack app approval/reinstall from the repo manifests, then rerun:

scripts/slack-foundation-bots-doctor.py --channel ai-claudebox --update-manifests --invite
scripts/slack-foundation-bots-doctor.py --channel ai-claudebox --invite

After that, remove/re-add ci-claudebox-bot-smoke on this PR. The expected proof is the Aztec Foundation CI bot smoke PR-CI job passing with a real chat.postMessage hello to #ai-claudebox.

[AztecBot]

ClaudeBox CI bot smoke update:

• PR branch is now a single commit; check-squashed passes.
• Push/synchronize path proves the secret is configured and Slack auth.test passes.
• Label-triggered PR-CI path now prints the channel diagnostics. Latest run failed at the expected live Slack app blocker:
  • chat.postMessage: not_in_channel
  • conversations.info: ok
  • conversations.join: missing_scope, needed channels:join
  • provided scopes do not include channels:join or chat:write.public

Repo-side smoke is doing its job now. Remaining action is Slack-side: approve/reinstall the Aztec Foundation CI bot with the scopes in claudebox-server/slack-ci-app-manifest.json, then remove/re-add ci-claudebox-bot-smoke to rerun the posting proof.