Webhook receiver: Plane deliveries trigger a tick (PAD-7)

agentd webhook-serve (agentd/webhook.py, stdlib): verifies X-Plane-Signature
(HMAC-SHA256 hex of the body, constant-time; 401 on missing/bad), routes by
data.project to a configured tenant (others 202), coalesces deliveries within
3 s into one tick, runs one more tick when deliveries arrive during a tick,
and retries every 15 s for up to 2 min while the lock is held (tick command
exit 75: flock -E 75 in the cron scripts, cli tick on Busy). Ticks run in a
systemd scope so restarting the receiver never kills one. Log:
<log_dir>/webhook.log; GET /healthz.

Config: webhook section (key names only, PLANE_WEBHOOK_SECRET scrubbed from
child envs like the Plane tokens), notify: {kind: none} as a no-op hook
called on every state move; the unused per-project webhook_secret_key is
gone (Plane webhooks are workspace-level). systemd unit for the LXC and
tools/plane-webhook.py to create/rotate the Plane webhook as the workspace
admin (secret straight into the Vault, never printed).

config/agentd.yaml

@@ -13,6 +13,21 @@ agentd:
   comment_max_chars: 6000
   cli_terminal: oregon
 
+# Plane webhook receiver (`agentd webhook-serve`, systemd plane-agentd-webhook.service; docs/runbook.md "Webhook").
+# One workspace-level Plane webhook (work items + comments) -> POST http://10.77.10.249:8790/plane -> one tick.
+webhook:
+  bind: 10.77.10.249                  # LAN only (Plane VM 10.77.10.68 is on the same /24)
+  port: 8790
+  path: /plane
+  secret_key: PLANE_WEBHOOK_SECRET    # Vault key name; the value is injected by agent-access.py exec --secret-env
+  # the cron script holds `flock -n -E 75`; --scope moves the tick out of the receiver's cgroup, so restarting the
+  # receiver never kills a running tick
+  tick_command: [systemd-run, --scope, --quiet, --collect, /opt/plane-agentd/cron/agentd-tick-lxc.sh]
+  debounce_seconds: 3                 # deliveries within this window -> one tick
+  retry_seconds: 15                   # lock busy -> retry every 15 s ...
+  retry_window_seconds: 120           # ... for up to 2 min; then the cron tick covers it
+notify: {kind: none}                  # notification hook, no-op (no ntfy service); core calls it on every state move
+
 terminals:
   win10:
     transport: warpgate-ssh
@@ -85,4 +100,3 @@ projects:
     timeout_hours: 4
     max_rounds_per_thread: 8
     max_progress_rounds: 12
-    # notify (ntfy) is phase 3: left out on purpose