fix(slack): retain public channel discovery without groups scope

[Vasallius]

Summary

Preserve Slack public-channel discovery when an app has channels:read but intentionally lacks groups:read.

users.conversations(types="public_channel,private_channel") requires both scope families. Today, a missing_scope response causes Hermes to abandon API discovery entirely and fall back to session history, even though a public-only request would succeed.

This change retries once with types="public_channel" after a combined request fails with missing_scope. If the public-only request also lacks scope, the existing quiet session-history fallback remains unchanged.

Production evidence

A long-running HawkFi gateway with channels:read but no groups:read logged the same channel-directory missing_scope failure every five minutes. The combined request prevented discovery of public channels the app was already authorized to read, and generated recurring operational noise.

Safety

• No scope expansion or credential changes.
• Private channels remain unavailable unless the app has the intended private-channel scope.
• Fallback is bounded to one extra request and retains the 20-page successful-pagination cap.
• Both Slack SDK exception responses and non-OK response objects are covered.

Verification

• uv run --frozen --extra dev pytest tests/gateway/test_channel_directory.py -q — 46 passed
• uv run --frozen --extra dev ruff check gateway/channel_directory.py tests/gateway/test_channel_directory.py — passed
• git diff --check — passed

Tests cover response-object fallback, exception fallback, and the no-public-scope quiet fallback.