feat(personal-community-sentiment-triage): add opt-in Slack rich blocks

[wscurran]

Description

Depends on #53.

This is a stacked draft based on #53's Hermes 0.18 upgrade. While #53 remains
open, GitHub will show its dependency changes in this PR; after #53 merges, the
diff will reduce to this follow-up.

Hermes 0.18 includes optional Slack Block Kit rendering, but this example owns
its configuration generator and does not inherit NemoClaw's Slack manifest.
Upgrading the base image alone therefore leaves rich-block rendering disabled.

This change completes the Community-side integration:

• Advance generated Hermes configuration to schema 32 and preserve
  agent.verify_on_stop: false.
• Add NEMOCLAW_SLACK_RICH_BLOCKS, accepting only true or false and
  defaulting to false.
• Pass the setting through .env.example, the staged Dockerfile arguments, and
  generate-config.ts.
• Render the resolved value as platforms.slack.extra.rich_blocks when Slack is
  configured.
• Add a build-time smoke test for Hermes 0.18's native three-column table
  renderer.
• Prefer Hermes 0.18's sanitized request.body and
  response.assistant_message NeMo Relay hook payloads while retaining the
  legacy rich-kwargs fallbacks.
• Document how to opt in and refresh remaining Hermes 0.14-specific comments.

The default remains backward-compatible. Existing deployments retain
plain-text Slack responses unless they explicitly set
NEMOCLAW_SLACK_RICH_BLOCKS=true.

No additional Slack OAuth scopes or app reinstall are required.

Verification

• python scripts/check_license_headers.py --check
• git diff --check
• All example shell scripts pass bash -n.
• All example Python files compile successfully.
• Focused generator and NeMo Relay unit suite passes (9 tests).
• Changed Python files pass Ruff lint and formatting checks.
• Tests cover schema 32, verify_on_stop: false, default-off, explicit
  true/false, invalid-value rejection, and Slack-disabled behavior.
• Tests cover Hermes 0.18 sanitized request/response payloads, legacy raw
  provider responses, and paired tool-call IDs.
• The renderer smoke uses the Hermes v2026.7.1
  plugins.platforms.slack.block_kit.render_blocks API and requires one native
  three-column table block.
• Full sandbox image build and live Slack table canary. Docker is unavailable
  in the authoring environment; every image build now executes the renderer
  smoke automatically.
• Live NeMo Relay ATIF/Phoenix finalization check.

Release And Compliance

• No secrets, local .env files, private certificates, snapshots, or token
  caches are included.
• No third-party dependencies are added.
• Public documentation is free of internal-only links or private workspace
  details.
• Commit includes DCO sign-off (git commit -s).

[wscurran]

Keeping in draft until #53 is merged in.