Alert routing (webhooks)

Verdicts that need a human should not wait for someone to open a dashboard. Alert routing pushes DENY and REQUIRE_APPROVE events to Slack, Linear, Jira, or a generic webhook.

Config lives in .kya/config.json (project) or ~/.kya/config.json (global):

{
  "notify": {
    "webhooks": [
      { "url": "https://hooks.slack.com/services/...", "template": "slack", "events": ["DENY", "REQUIRE_APPROVE"] },
      { "url": "https://example.invalid/jira", "template": "jira", "events": ["DENY"] }
    ]
  }
}

KYA_NOTIFY_WEBHOOK=<url> is the zero-config variant with a generic payload.

• Retries with exponential backoff (250ms / 1s / 4s + jitter) and per-attempt timeouts.
• Per-URL circuit breaker and a send rate limiter.
• Payloads are built only from redacted trail fields, with a minimized fallback when the secret scan trips.
• Short-lived hook / wrap spawns hand delivery to a detached helper (kya notify-flush), so the gate path never waits on the network.

The human decision still happens on the plane: policy and approvals.