fix: deliver subagent completion announces to Slack without invalid thread_ts (#31105)

* fix(subagent): avoid invalid Slack thread_ts for bound completion announces

* build: regenerate host env security policy swift

---------

Co-authored-by: User <user@example.com>
Co-authored-by: Peter Steinberger <steipete@gmail.com>

src/agents/subagent-announce.ts

@@ -517,7 +517,14 @@ async function resolveSubagentCompletionOrigin(params: {
       channel: route.binding.conversation.channel,
       accountId: route.binding.conversation.accountId,
       to: `channel:${route.binding.conversation.conversationId}`,
-      threadId: route.binding.conversation.conversationId,
+      // `conversationId` identifies the target conversation (channel/DM/thread),
+      // but it is not always a thread identifier. Passing it as `threadId` breaks
+      // Slack DM/top-level delivery by forcing an invalid thread_ts. Preserve only
+      // explicit requester thread hints for channels that actually use threading.
+      threadId:
+        requesterOrigin?.threadId != null && requesterOrigin.threadId !== ""
+          ? String(requesterOrigin.threadId)
+          : undefined,
     };
     return {
       // Bound target is authoritative; requester hints fill only missing fields.