BugWatch alert webhooks

When a BugWatch alert rule fires (issue-count or metric-threshold), the platform POSTs to the rule's webhookUrl:

{
  "rule": { "id": "bwr_664f…", "name": "5xx spike", "type": "METRIC_THRESHOLD" },
  "severity": "critical",
  "value": 187,
  "title": "5xx spike: http_5xx_total is 187 (>= 100)",
  "firedAt": "2026-08-05T11:42:00.000Z"
}

These deliveries are currently UNSIGNED — no x-newinstance-signature header, no retries. Treat an alert webhook as a notification to go look, not as an instruction to act on blindly:

• Put an unguessable path segment in your webhookUrl (e.g. /hooks/bw-alert-8f3a9c2e/) as a shared-secret stand-in.
• Confirm the incident in the dashboard (or via your own monitoring) before triggering automation.
• An incident record is also opened in the dashboard for every firing, deduplicated per rule while open.

Severities: info | warning | critical.