slack DM: warn reviewers about IAP roundtrip dropping the action URL

[phosphore]

Summary

Reported by a reviewer (Nico, post-merge of #9):

Small UX thing about the links to be aware of: when I clicked on the link, I was first asked to sign-in with google; once signed-in, I was on the pam homepage. So I went back to this message to click the link again to get the runin-prod-ro permission.

Root cause: IAP's OAuth roundtrip during the first sign-in in a fresh browser session occasionally strips the action URL's query string (which is where the proposal token lives — ?f=/environments/.../proposal/{token}). The reviewer lands on pam.wavemm.net/ (homepage) instead of the proposal-acceptance view. Clicking the Slack button again works because the IAP cookie is now fresh.

We don't directly control the IAP redirect contract, so the cheapest fix is to tell reviewers inline what to do. Adding a one-liner to the existing ContextBlock under the "Approve in JIT" button.

Diff

The new line appended to the existing context message:

ℹ️ First click after a long break may land you on the JIT homepage instead of the approval page (IAP login). If so, just click "Approve in JIT" again from this message — your IAP cookie is now fresh.

Future improvements (out of scope)

• Frontend detection: if view.js sees the page loaded without a ?f= param but the Referer is accounts.google.com, render an explicit banner. More work.
• Server-side: pass the original URL as state in the OAuth roundtrip. Would require IAP/load-balancer config we don't fully own.

Test plan

• Visual smoke-test on rev URL after deploy: submit an MPA elevation, verify the reviewer DM contains the new line in the context block.
• No new unit tests — the existing tests don't assert on the literal context-block prose, so the change is invisible to the test suite (intentional: the prose is presentation-layer).

🤖 Generated with Claude Code