feat(notify): push the operator when runtime coverage collapses (JEF-427)

[thejefflarson]

Closes JEF-427.

What

The breach notifier (ADR-0018) is protector's one sanctioned outbound push — but it fires only on breach decisions, and a blind engine makes none. So the exact moment protector's own eBPF sensors go dark (the incident shape), the notifier stayed silent; coverage collapse was pull-only (dashboard + /metrics), nothing screamed.

This adds a second, narrow event on the same sanctioned path: an edge-triggered runtime-coverage notice consuming JEF-421's stall edge.

Behavior

• Edge-triggered, deduped. Fires exactly once when a was-covering fleet goes fully dark past the JEF-421 stall debounce (runtime_coverage_degraded), and once on recovery (runtime_coverage_restored) — never per pass, reusing JEF-421's hysteresis so a routine DaemonSet roll never strobes it. stamp_runtime_coverage now returns Option<CoverageEdge>; the pass loop fires the push on Some.
• Same posture as the breach notice. Off unless PROTECTOR_ENGINE_NOTIFY_URL is set → zero outbound calls, byte-identical to today. Same bounded, in-cluster-validated, fail-safe client (reuses self.url/self.client); a failure is logged once and dropped, never touching a verdict, actuation, or the journal.
• Counts-only, redacted by construction. Payload = event tag + feed label (Runtime, our own constant) + N-of-M blind counts + a last-observed age. No node names, no topology, no secrets, no CVEs — there is no untrusted cluster string in it to sanitize.

Acceptance (all covered)

• ✅ URL configured → healthy→all-blind transition fires exactly one notice; recovery fires one "restored".
• ✅ Disabled (no URL) → zero outbound calls.
• ✅ Payload counts-only; ADR-0018 redaction upheld and tested.
• ✅ Dwell/debounce prevents flapping during a roll (JEF-421 hysteresis reused).

Tests

Counts-only payloads (degraded + restored), the edge→notice mapping, the disabled-notifier no-op, and a Findings-level test that the edge fires exactly once per collapse and once per recovery. Full suite green (cargo test -p protector), clippy + fmt clean. ADR-0018 extended to record the new edge on the sanctioned egress path.

🤖 Generated with Claude Code