ci: page Slack when a release-critical workflow fails

[ericviana]

Adds .github/workflows/pipeline-alert.yml: a Slack page when a release-critical workflow fails in this repo.

Why: the publish pipeline here was silently broken for two and a half months and nobody found out until someone went looking. Now that the sync and release pipelines are deterministic, the remaining failure mode is a pipeline that stops with a "needs human" hard failure and nobody notices, which is exactly what this closes.

Design notes:

• Watches only release-critical workflows (see the workflows: list), on completed, and fires only when the conclusion is failure.
• workflow_dispatch sends a test ping so the wiring can be proven without breaking anything.
• If SLACK_WEBHOOK_URL is not set, the job FAILS loudly rather than skipping quietly. An alerting job that silently does nothing is worse than no alerting.
• A non-200 from Slack also fails the job, with the response body printed.
• Every interpolated value goes through env: and the payload is built with jq --arg, so no workflow-context value is ever spliced into a shell or JSON string directly.

Setup needed once per repo, after merge: create a Slack incoming webhook, then gh secret set SLACK_WEBHOOK_URL --repo blindpaylabs/<repo>, then run the workflow manually to get the confirmation ping.

https://claude.ai/code/session_01F1stiNzuNtJXoXtiW9ZCbs

[BernardoSM]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.