[blaipr]

Builds on the notifications merged in #12, renamed and hardened before 0.2.0.

Webhooks (was notifications)

• Config key webhooks:; API /api/v1/webhooks, /{id} (with its last 50 sends) and /{id}/test; metrics unified_gitops_webhooks_total and unified_gitops_webhook_duration_seconds; docs in docs/webhooks.md.
• Ascender and AWX only through the template's own webhook receiver (GitLab mode, its key): trigger and extra_vars are gone, so no user token and no "Prompt on launch" trap.
• applications: is all, a list, or none (left out or []), as an API key reads its applications.
• The API says how each webhook sends (auth, header names, signature header, timeout, retries), never a value.

Fixes from a release sweep

• Drift is told apart from a commit by the git tree of the application's own folder, not the repository's HEAD (a commit to another folder used to hide drift). Works on shallow clones.
• Failed to drifted fires drift_detected; a standing rollback keeps scheduled checks quiet and is never the drift reference; the cause is left out when git cannot tell.
• A send holds one of the 8 slots only during an attempt, not through retry backoff; requests that cannot be built (a credential with a newline, a missing field) are not retried; queued sends are drained at shutdown within the grace period.
• Templates: one parser for validation and rendering; an absent value is null outside quotes.
• Headers: collisions with auth or signature headers are refused at load, values replaced not duplicated; auth: {header: ...} is strict; Basic allows an empty password.
• An error about a job template URL shows only its origin.

Metrics: unified_gitops_git_requests_total{project,operation,outcome} and unified_gitops_git_request_duration_seconds for every clone, pull and rollback fetch.

Also drops an unused MPL-2.0 allowance from deny.toml. 288 tests, clippy, audit and deny clean.