chore: allow preview environment subject in slack-config STS policy - #80

#81)

Adds `repo:tempoxyz@211589300/tip.bot@1232143975:environment:production`
to the `slack-config` trust policy, the production counterpart to #80:
the `update_slack_app` job runs in `environment: production`, so its
OIDC subject is the environment form and the existing `refs/heads/main`
subject does not match it. Without this, the production Slack app update
would fail to mint once #79 lands.

Also rewrites the subject comment to reflect that all rotating jobs run
in environments; the ref/event subjects remain for any future job that
rotates without one.

Removes the `ref:refs/heads/main` and `pull_request` subjects from the
`slack-config` trust policy. Every job that rotates the Slack config
token runs in a GitHub environment, so those subjects match nothing
today — jobs with an `environment:` key always present the
environment-form OIDC subject (#80, #81).

Dropping them also tightens the grant: with `pull_request` present, any
same-repo PR workflow job without an environment could mint a `secrets:
write` token; now minting requires entering the `preview` or
`production` environment, so any deployment protection rules on those
environments gate token minting too. A future environment-less job that
needs to rotate can add its subject back in a reviewed diff.