ci: Slack-notify failed pipeline runs only

Viktor doesn't want a Slack message for every CI run — only failures.
The infra apply pipeline posted a status line to #general on every push,
and the renew-tls / postmortem-todos / registry-config-sync /
pve-nfs-exports-sync crons posted on every scheduled run (~30+ routine
messages a week). Now: the apply pipeline's success post is gone
(notify-failure already covers failures), all cron notifies are
status:[failure] with explicit FAILED texts, and drift-detection is
silent when all stacks are clean (still posts drift findings and errors,
and gains a hard-failure catch step it previously lacked). Kept:
notify-nonadmin-push (org audit feed) and the actionable provision-user
post. Per-app deploy template in ci-cd.md updated to match.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.woodpecker/drift-detection.yml

@@ -147,13 +147,30 @@ steps:
         echo "Drift: ${DRIFTED:-none}"
         echo "Errors: ${ERRORS:-none}"
 
-        # ── Slack alert if drift found ──
+        # ── Slack only when something is WRONG (drift or errors) ──
+        # All-clean runs are silent (Viktor 2026-07-02: CI notifies on
+        # failed/actionable runs only; clean is the daily normal).
         if [ -n "$DRIFTED" ]; then
           curl -s -X POST -H 'Content-type: application/json' \
             --data "{\"channel\":\"general\",\"text\":\":warning: Drift detected in:${DRIFTED}\nClean: ${CLEAN} stacks. Errors:${ERRORS:-none}\"}" \
             "$SLACK_WEBHOOK" || true
-        else
+        elif [ -n "$ERRORS" ]; then
           curl -s -X POST -H 'Content-type: application/json' \
-            --data "{\"channel\":\"general\",\"text\":\":white_check_mark: Drift detection: all ${CLEAN} stacks clean${ERRORS:+. Errors: $ERRORS}\"}" \
+            --data "{\"channel\":\"general\",\"text\":\":red_circle: Drift detection had errors: ${ERRORS} (clean: ${CLEAN})\"}" \
             "$SLACK_WEBHOOK" || true
         fi
+
+  # Hard-failure catch: the in-script posts above never run if the step
+  # itself crashes early — this step is the only signal for that case.
+  - name: notify-failure
+    image: curlimages/curl
+    commands:
+      - |
+        curl -s -X POST -H 'Content-type: application/json' \
+          --data "{\"channel\":\"general\",\"text\":\":red_circle: Drift-detection pipeline FAILED (crashed before reporting)\"}" \
+          "$SLACK_WEBHOOK" || true
+    environment:
+      SLACK_WEBHOOK:
+        from_secret: slack_webhook
+    when:
+      status: [failure]