goldmane-trail: polish follow-ups #57/#59/#61/#62/#63 + digest→#alerts

Completes the Goldmane who-talks-to-whom trail (ADR-0014), implemented by a
subagent workflow (distinct stacks in parallel, docs last):

- #57 Whisker gated ingress: ingress_factory (whisker.viktorbarzin.me,
  auth=required, Authentik-gated) + a NetworkPolicy allowing traefik->whisker:8081
  (the operator's whisker NP default-denies ingress). calico stack.
- #61 pipeline health: AggregatorDown + DigestFailing Prometheus alerts
  (prometheus_chart_values.tpl) + cluster-health check #48.
- #59 service-identity labels on the multi-Service namespaces (monitoring's 5
  TF-managed deployments + dbaas), with the KYVERNO_LIFECYCLE_V1 marker so they
  update in-place.
- #62/#63 docs: docs/runbooks/goldmane-flow-trail.md (new), service-catalog,
  security.md + monitoring.md east-west sections, ADR-0014 as-built, CONTEXT.md.
  #62 = the SQL to derive the Wave-1 per-namespace egress allowlist from the
  edge table (feeds code-8ywc; enforce-flips out of scope).

Also fixes the digest's Slack target: #security override 404s channel_not_found
because the shared alertmanager_slack_api_url webhook's app isn't a member of
#security (this likely also breaks alertmanager's slack-security receiver — flagged
in the runbook). Routed to #alerts (the webhook's working channel) until the app
is invited; verified a real digest run posts cleanly (360 edges).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

stacks/goldmane-edge-aggregator/main.tf

@@ -449,8 +449,16 @@ resource "kubernetes_cron_job_v1" "digest" {
                 }
               }
               env {
-                name  = "SLACK_CHANNEL"
-                value = "#security"
+                name = "SLACK_CHANNEL"
+                # The shared alertmanager_slack_api_url incoming webhook's Slack
+                # app is NOT a member of #security, so overriding the channel to
+                # it returns HTTP 404 channel_not_found (verified 2026-06-25).
+                # alertmanager's own slack-security receiver shares this webhook
+                # and almost certainly hits the same wall. Post to #alerts (the
+                # webhook's working channel, same as alert-digest) until the app
+                # is invited to #security, then flip this back. See
+                # docs/runbooks/goldmane-flow-trail.md.
+                value = "#alerts"
               }
 
               resources {