feat(tools): add "webhook" toolset for outbound notifications

[dwin-gharibi]

Closes #3640

Summary

New built-in webhook toolset — send_webhook(url, message, provider?) — that POSTs a provider-shaped JSON payload to a webhook and reports delivery status. Providers: slack, discord, ifttt, telegram, mattermost, rocketchat, googlechat, teams, generic. Reuses httpclient.NewSafeClient (refuses non-public IPs). See contribution/webhook/ISSUE.md for motivation and payload shapes.

Changes

File	Change
pkg/tools/builtin/webhook/webhook.go	New — toolset, pure buildPayload, injectable httpDoer.
pkg/tools/builtin/webhook/webhook_test.go	New — payload shaping per provider, aliases, send success / non-2xx / network-error / validation.
pkg/teamloader/toolsets/toolsets.go	Register the webhook creator.
pkg/teamloader/toolsets/catalog.go	Catalog entry (enforced by the drift-guard test).
docs/configuration/tools/index.md, docs/tools/webhook/index.md	Docs.

Testing

go test ./pkg/tools/builtin/webhook/ ./pkg/teamloader/toolsets/

Payload construction is a pure function and the HTTP client is injected, so every path is covered with a fake doer — no network. gofmt -l and go vet clean. (CI runs task lint / task test.)

Notes

• Safe, message-shaped subset of an HTTP POST — not a general HTTP client (SSRF surface).
• Config-defined named/allowlisted webhooks noted as future work.