Closes #3334.

When two or more LibreFang agents are bound to the same channel (one Slack
workspace with both a "support" agent and a "research" agent, etc.) the
router can resolve different agents on consecutive messages in the same
thread — last @-mention wins, sticky-TTL falls off, etc. — and both agents
end up replying. Add a single-process claim registry so each `(channel,
thread)` is owned by one agent for the configured TTL; an explicit
@-mention re-claims for the new agent.

Changes:

- `librefang-channels/src/thread_ownership.rs` (new)
  - `ThreadKey { channel, thread }` — hashable identity. Empty channel or
    thread rejected at construction.
  - `Claim` — agent_id + monotonic `Instant` claimed_at + per-claim TTL.
  - `ThreadOwnershipRegistry` — `DashMap` of claims, `decide(key,
    candidate, was_mentioned)` returns `Allow` (claim or extend) or
    `Suppress { holder }`. `decide_at` / `sweep_expired_at` are test
    seams accepting an explicit `Instant`.
  - 9 unit tests cover empty-key reject, first-claim, suppression,
    @-mention override, in-place extend, expired-claim takeover, sweep
    selectivity, ttl-zero clamp, distinct-thread isolation.

- `librefang-types/src/config/types.rs`
  - `ChannelOverrides::thread_ownership_enabled: bool` defaults to
    `true`. Setting to `false` makes the bridge skip the registry — the
    "broadcast" channel escape hatch.

- `librefang-channels/src/bridge.rs`
  - `BridgeManager` owns an `Arc<ThreadOwnershipRegistry>` and threads it
    through `start_adapter` → `flush_debounced` → `dispatch_message` →
    `dispatch_with_blocks`. Both dispatch paths consult the registry
    after `resolve_or_fallback` and before any side effect, suppressing
    with a `debug!` log line on conflict. DMs (`!is_group`) and
    untreaded messages bypass entirely.
  - 6 new unit tests cover DM bypass, untreaded-group bypass, first
    claim, second-agent suppress, @-mention override, override-disabled
    bypass — all using a small bridge-side helper that mirrors the same
    metadata reads the dispatch path performs.

Pre-flight: `cargo check --workspace --all-targets` clean,
`cargo clippy --workspace --all-targets -- -D warnings` clean,
`cargo test -p librefang-channels --lib` 835 / `librefang-types --lib`
702 — both green.

Out of scope (per the issue): multi-process / multi-daemon coordination
(slack-forwarder shared store). Tracked as a follow-up if a user reports
duplicate replies across daemons. The in-memory registry is bounded by
the per-thread TTL plus an opt-in `sweep_expired` call, so memory stays
under control without a persistence layer.