ci(release): notify duty engineers of prerelease failures

[purp]

Summary

Send a Slack notification when a Release Tag prerelease attempt fails, with a configurable mention and a link to that attempt. Notifications are best effort and skip cleanly while the webhook is unset.

Notifications are sent to the triage channel via a webhook specified in SLACK_OPENSHELL_TRIAGE_WEBHOOK_URL and will at-mention the triage engineer so that they can respond. The webhook and mention are stored in repository secrets; the mention uses SLACK_OPENSHELL_TRIAGE_MENTION.

Related Issue

Closes #4132

Changes

• Add a failure notification job covering all prerelease build, qualification, and publication dependencies; successful attempts and stable releases do not notify.
• Include the prerelease tag, attempt number, failed run link, and mention from the SLACK_OPENSHELL_TRIAGE_MENTION secret. An unset mention secret still sends the notification.
• Use the reusable SLACK_OPENSHELL_TRIAGE_WEBHOOK_URL secret, a clean missing-secret skip, bounded delivery timeouts, and continue-on-error.
• Document setup and behavior in CI.md.

Testing

• Scoped checks pass: actionlint, ShellCheck for the notification script, and git diff --check.
• Repository pre-commit hook passes, including Markdown lint, formatting, license checks, and Rust lint.
• Local HTTP checks verify missing-secret skip, JSON payload, configured group and replacement user mentions, unset mention, attempt link, and HTTP failure handling. No message was sent to Slack.
• Dependency inspection covers all 21 prerelease jobs and confirms no release job waits for the notifier; focused code review passed.
• Offline Zizmor comparison has no new high-severity findings; the same three existing ci:latest image warnings appear on the base.
• Unit/E2E suites are not applicable to this workflow-only change. Live Slack delivery was not tested.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture documentation is not applicable; CI setup documentation is updated.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.