fix(signal): route denied DMs through _handle_message for pairing code

Previously _check_inbound_policy returned (False, chat_id) for DMs
that failed the allowlist and the caller dropped them — so unapproved
DM senders never saw a pairing code. Mirror Slack: when the policy
gate denies a DM but dm.enabled is true, still call
_handle_message(content="", is_dm=True) so BaseChannel can issue the
pairing reply. Group denials stay a hard drop.

Combined with the previous is_dm forwarding, unapproved DM senders
now receive a pairing code through the standard flow.

Addresses review comment on PR #3852.

nanobot/channels/signal.py

@@ -704,6 +704,15 @@ class SignalChannel(BaseChannel):
             timestamp=timestamp,
         )
         if not allowed:
+            # Mirror Slack: let denied DMs reach _handle_message so the base
+            # class can reply with a pairing code. Group denials stay dropped.
+            if not is_group_message and self.config.dm.enabled:
+                await self._handle_message(
+                    sender_id=sender_id,
+                    chat_id=chat_id,
+                    content="",
+                    is_dm=True,
+                )
             return
 
         content, media_paths = self._assemble_inbound_content(