skym-notify: Feishu messages and a healthchecks.io dead man's switch

[bencode]

A new binary, skym-notify, that reads the server's API like any reader (the server is unchanged) and runs beside it.

• Every 15 s: reads the open incidents (muted included) and compares them with what it announced.
  • New: open, not muted, warn or critical.
  • Worse: announced below critical, now critical; once, and only once a mute ends.
  • Resolved: gone for 10 minutes; one that comes back sooner says nothing. A truncated list resolves nothing.
• One message per pass to a Feishu custom bot (optional signature), 5 entries then "… and N more". State advances only when Feishu answers code: 0; otherwise it is resent next pass. State is a JSON file saved atomically and retried until saved.
• healthchecks.io: pinged every minute while the server could be read in the last two passes; /fail once Feishu has failed for 10 minutes.
• Secrets (token, webhook, signing secret, ping URL) never appear in Debug output, errors or logs.
• deploy/Dockerfile.notify, deploy/notify.example.toml, docs (install, architecture, README).

Tests: unit tests for the decisions, message and signature; integration tests against local fakes of the API, Feishu and healthchecks.io. cargo-mutants: 0 missed (the loop in main.rs excluded). Reviewed independently; fixes applied.