feat(bridges): render agents under their display name, defused on every platform

[raullopez-sandbox]

Third PR in the display-name stack. Base is #325 — review that one first.

• feat(console): offer a slug instead of rejecting an agent name #325 — Console slug suggestion (open; feat(agents): store an optional human display name #326's display_name column has merged into it)
• feat(agents): store an optional human display name #326 — the display_name column + API (merged)
• feat(bridges): render agents under their display name, defused on every platform #330 (this) — render it on Slack and Discord, and defuse it on all five
• feat(bridges): render agents under their display name on Teams and Telegram #338 — render it on Teams and Telegram

What changes

Agents are addressed by a lowercase identifier (switchdev), and until now that
is also what humans saw. This shows the display name instead, where one is set.

Rendering lands on Slack and Discord here. The escaping lands on all five.
That split is deliberate: _ping_operator is on the base class, so the moment
this PR merges every platform inlines a display name into a message body —
including the three that do not otherwise render one yet. Leaving the escaping
to the later per-platform PRs would leave main exposed in between.

What deliberately does not change

• clients.display_name is still the Matrix identity stamped onto every event as sender_name. Breaking this re-imports an agent's own message as a third-party human — a puppet identity gets minted and the agent appears twice.
• Icons are still derived from the identifier.
• The echo filters are untouched and name-independent: Slack matches on bot_id, Discord on webhook_id/author.id.
• Mattermost's name-based check is out of scope and unaffected — it needs a PUT /bots/{id} at provisioning rather than a render change.

How

bridge_core installs an AgentPresentation resolver on the adapter, and
agent_rendering(name) returns one AgentRendering carrying the field label,
the body-escaped label, and the icon — one DB lookup per send, where the
first draft would have done two.

Slack keeps its white-background icon recolouring by overriding the pure
adapt_icon_url(raw, name) hook rather than the accessor. This matters: Slack's
old override took a name and re-queried, so a naive paired accessor would have
silently bypassed the recolour.

Escaping: a safe default, specialised by override

escape_label_for_body now defuses @ and ] with a zero-width space instead
of returning the label unchanged. Those two cover the constructs a name can use
to claim something it is not: addressing somebody, and rendering an anchor whose
destination it chose and whose visible text hides it.

The ] and not the [ — the zero-width space has to break the ]( adjacency
every Markdown dialect requires. After the [ it lands inside the visible text
and the link still matches; verified against the compiled patterns rather than
assumed.

A platform that adds no override is now safe. Before, it rendered a forged name
correctly and said nothing.

An override adds to the base rule; it does not replace it

A review flagged that Slack and Discord were still open, and its verifiers
refuted it. The finding was correct. Probing the real pipeline:

display name	platform	before
@opsbot	Slack	@U123 *<!subteam^S999>* needs your input.	real group ping
@opsbot	Discord	@123 **<@&4242>** needs your input.	real role ping
@alice	Discord	@123 **<@777>** needs your input.	real user ping

Neither adapter is wrong on its own. A label never has to reach the platform in
the platform's syntax: Switch's own outbound mention pass runs over the
finished body, after the label is inlined, and turns a plain @handle into a
real mention. The defect is in the composition of two individually-correct
functions — which is why reading either one refutes it. Every verifier checked
whether markup could survive the escaper; none checked what ran afterwards.

Both now call super(). Three regression tests, each verified to fail without
the fix.

Per platform, on top of the base

• Discord — escapes markdown and mentions, and inserts U+200B after <; Discord resolves <#…>, <t:…> and <:emoji:…> out of raw content and has no backslash escape for <. Every send also passes AllowedMentions(everyone=False), so a mass ping is refused by permission as well as defused in text.
• Slack — escapes &, <, >. mrkdwn has no escape sequence for *, _, ~ or backtick; the docstring says so rather than implying coverage it does not have.
• Teams — breaks <at>, which _mention_entities finds in a rendered body and pairs with a live entity. Broken syntax rather than entity escaping: an Adaptive Card is not HTML, so < would be shown to the reader.
• Field values are left unescaped on purpose — platforms render those verbatim, so escaping would show the entities to the reader.

Discord may reject a display name as a webhook username with a 400. That falls
back to the identifier and latches for the rest of the send, so a multi-call
send cannot post half under each name.

Known and disclosed, not fixed

• Emphasis. A label's * or _ can unbalance the run around it. Cosmetic; the line held is that forged markup is closed while broken formatting is not worth an escape that would appear in every ordinary name.
• A bare URL still auto-links. A display name is never dereferenced by the server — unlike icon_url, which is hardened precisely because the server fetches it — and an agent's owner can already have it post any link.

Verification

• 2176 tests pass, ruff format + ruff check clean, mypy clean on 186 files. Verified on this commit in isolation, not just at the tip of the stack, since these merge one at a time.
• Test-merged onto current main in a throwaway worktree: clean, 2195 pass. fix(slack): resolve agent mentions that crossed a workspace boundary #327's Slack change touches the inbound mention path, not the outbound one, so it does not reopen this.
• The new tests were mutation-tested: breaking the resolver wiring, dropping icon_url, un-escaping the body label, and removing either super() call each make specific tests fail. One mutation passed, which exposed an accessor with zero production callers — since deleted.
• Payloads were captured from the real adapters and diffed before/after, with before rebound to the actual prior implementation rather than a mock-up, and every row asserted to differ.

Also in here: 22 test assertions contained literal invisible U+200B
characters, so assert "@<U+200B>channel" in x sat directly above
assert "@channel" not in x looking like a contradiction. Converted to
\u200b escapes; the tests still pass, confirming it was purely presentational.

🤖 Generated with Claude Code