fix: warn when gl-set-slack targets legacy service on a Slack-app repo

What

gl-set-slack now detects when the repo's active Slack integration is the GitLab for Slack app (gitlab-slack-application) and prints a loud warning, instead of silently no-op'ing while reporting success. Docs now clearly separate the two integrations and the app's per-event-channel requirement.

Why (issue #6 (closed))

gl-set-slack.sh writes only to the legacy services/slack (incoming-webhook) integration. On a repo where the modern GitLab for Slack app is active, that edit does nothing for live notifications, yet the command prints "...is ON" — so it looks like it worked. The app also routes per-event channels: enabling issues_events/note_events without issue_channel/note_channel silently drops events.

Changes

• scripts/gl-set-slack.sh — GET projects/:id/integrations; if gitlab-slack-application is active, warn to stderr (stdout pipeline / success line untouched) with how to configure the app. Fail-open: a lookup error leaves the warning off and still writes the legacy service. #!/bin/bash -e safe (|| true guards the pipeline).
• makefiles/gitlab.mk — gl-set-slack ## description now says legacy webhook (NOT the GitLab for Slack app).
• README.md / agent-instructions/agentic-workflow.md — document legacy-vs-app + per-event channels.

Scope

Required docs + a detection warning. Full app-management tooling (PUT per-event channels to gitlab-slack-application) is intentionally deferred as a follow-up — it needs a live Slack-app repo to test. Per the issue's API note, work_item_channel is silently ignored by the current GitLab version.

Verification

• make validate passes; bash -n clean.
• jq detection tested against app-active / app-inactive / only-legacy / error-object / empty inputs — emits the slug only when the app is active.
• Self-review (code-self-reviewer): PASS, no blocking findings; applied its nits (removed redundant redirect, documented fail-open, tightened README).

Closes #6 (closed)

Closes #6 (closed)