docs(domain-skills): slack file downloads

[Larkooo]

Adds domain-skills/slack/files.md: downloading workspace-shared files given a permalink.

Non-obvious findings this captures:

• The FILEID segment of a permalink routes; the filename segment is cosmetic — "same URL, replace the number" silently returns the same file.
• The permalink HTML (fetched with just the d cookie, no browser tab needed) embeds a usable xoxc api_token + team_id — much simpler than digging localConfig_v2 out of the app.slack.com origin.
• The d cookie is HttpOnly, so read it via CDP Network.getCookies, not in-page JS.
• files.list can silently omit recent files; search.files is the reliable resolver.
• In a real tab the permalink sticks on "Redirecting…" forever (waiting for the desktop app) — a trap if you wait on it.

---

Summary by cubic

Adds docs for downloading Slack workspace-shared files from a permalink using the d cookie and the permalink-embedded xoxc token. Covers URL routing, reliable file lookup, and common traps.

• New Features
  • Added domain-skills/slack/files.md with a step-by-step flow.
  • Clarifies only FILEID routes; the filename segment is cosmetic.
  • Shows reading HttpOnly d via CDP and fetching permalink HTML to extract xoxc and team_id.
  • Explains API calls need token=<xoxc> plus the d cookie; download via url_private.
  • Recommends search.files over files.list; avoid waiting on the "Redirecting…" permalink tab.

^{Written for commit 61043a1. Summary will update on new commits.}

[browser-harness-review]

✅ Skill review passed

Reviewed 1 file(s) — no findings.

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[karaokedjodua]

Finn-loop review of 61043a1

CI: required checks passed | all 3 checks green (GitGuardian, cubic, skill-review)
Mergeability: clean

Review

Summary: Adds domain-skills/slack/files.md — a documentation skill for downloading Slack workspace-shared files from permalinks, covering auth via the d cookie (CDP), xoxc token extraction from permalink HTML, API patterns, and common traps.

1. Must fix before merge

None.

2. Should fix soon

None.

3. Safe to merge

Yes — docs-only addition, well-structured, all checks pass, merge is clean.

Notes

• No Paperclip issue linked; reviewed against PR body contract. All described points are covered.
• Labels that should be applied: loop-approved (token lacks admin rights to apply labels — please add manually).