GH-59: feat(sdk/integrations/discord): port client, types, sanitize

[alekspetrov]

Summary

Automated PR created by Pilot for task GH-59.

Closes #59

Changes

GitHub Issue #59: feat(sdk/integrations/discord): port client, types, sanitize

Context

Port the Discord chat connector's client + data layer into a new
sdk/integrations/discord/ package (package discord), zero pilot deps. Conforms
to the sdk/core chat-bridge contract (.agent/system/chat-bridge-design.md;
references = sdk/integrations/telegram/ and sdk/integrations/slack/). Clone:
gh repo clone qf-studio/pilot /tmp/pilot-src -- --depth 1; port from
/tmp/pilot-src/internal/adapters/discord/. Discord delivery = Gateway WS —
the transport + bridge are the follow-up. This issue is the stdlib-only REST

• event parsing + sanitize layer. Discord is the last of 10 connectors.

Implementation

Port into sdk/integrations/discord/: client.go, types.go, sanitize.go
(+ table-driven tests). Transformations:

• Remove every github.com/qf-studio/pilot/... import; inject *slog.Logger
  (WithLogger). Replace any internal/text with sdk/util/text.
• client.go — REST client over net/http (https://discord.com/api/v10):
  SendMessage, SendMessageWithComponents (buttons via action rows),
  EditMessage, CreateInteractionResponse. Keep rate-limit handling.
• types.go — Discord Gateway/REST types (GatewayEvent, MessageCreate,
  InteractionCreate, User, action-row/button component types) + intents/
  opcodes constants + Config{ BotToken, BotID string; AllowedGuilds, AllowedChannels []string }. Parse GatewayEvent.d into MessageCreate/
  InteractionCreate; strip the bot-mention prefix from content. No WebSocket
  here (that's issue-2).
• sanitize.go — NEW: sanitizeMessageText(s, logger) via
  sdk/util/text.SanitizeUntrusted.
• DROP host-domain entirely: messenger.go, formatter.go, notifier.go,
  and the comms task-dispatch in handler.go.
• Tests use sdk/testutil only — add FakeDiscordToken = "test-discord-token".
• Do NOT port transport.go (Gateway WS) or the adapter — those are the
  follow-up (they reuse the existing gorilla/websocket dep). go.mod is
  unchanged here.

⛔ Touch ONLY sdk/integrations/discord/ and sdk/testutil/tokens.go.

Acceptance

• client.go, types.go, sanitize.go (+ tests) exist; NO messenger/formatter/notifier host-domain code.
• grep -rn "qf-studio/pilot" sdk/ nothing; inbound sanitize uses sdk/util/text; bot-mention stripped.
• go mod tidy a no-op (no new dep here — the REST layer is stdlib); sdk/{core,log,util,testutil} stdlib-only.
• go build ./..., go vet ./..., go test -race ./sdk/integrations/discord/... pass; gofmt -l sdk/ empty.

[alekspetrov]

🚧 Merge blocked: approval not wired

Environment stage requires pre-merge approval (environments.stage.require_approval: true) but the approval system is disabled (approval.enabled: false and/or approval.pre_merge.enabled: false).

To unblock: either enable approval in ~/.pilot/config.yaml (set approval.enabled: true + approval.pre_merge.enabled: true + add an approver), or merge manually with gh pr merge 61.

Tracked in #2598.