Webhook receiver: Plane deliveries trigger a tick (PAD-7)

agentd webhook-serve (agentd/webhook.py, stdlib): verifies X-Plane-Signature
(HMAC-SHA256 hex of the body, constant-time; 401 on missing/bad), routes by
data.project to a configured tenant (others 202), coalesces deliveries within
3 s into one tick, runs one more tick when deliveries arrive during a tick,
and retries every 15 s for up to 2 min while the lock is held (tick command
exit 75: flock -E 75 in the cron scripts, cli tick on Busy). Ticks run in a
systemd scope so restarting the receiver never kills one. Log:
<log_dir>/webhook.log; GET /healthz.

Config: webhook section (key names only, PLANE_WEBHOOK_SECRET scrubbed from
child envs like the Plane tokens), notify: {kind: none} as a no-op hook
called on every state move; the unused per-project webhook_secret_key is
gone (Plane webhooks are workspace-level). systemd unit for the LXC and
tools/plane-webhook.py to create/rotate the Plane webhook as the workspace
admin (secret straight into the Vault, never printed).

config/schema.json

@@ -36,6 +36,30 @@
         "cli_terminal": {"type": "string"}
       }
     },
+    "webhook": {
+      "type": "object",
+      "required": ["secret_key", "tick_command"],
+      "additionalProperties": false,
+      "properties": {
+        "bind": {"type": "string"},
+        "port": {"type": "integer", "minimum": 1},
+        "path": {"type": "string"},
+        "secret_key": {"type": "string"},
+        "tick_command": {"type": "array", "minItems": 1, "items": {"type": "string"}},
+        "tick_timeout_seconds": {"type": "integer", "minimum": 10},
+        "debounce_seconds": {"type": "number", "minimum": 0},
+        "retry_seconds": {"type": "number", "minimum": 1},
+        "retry_window_seconds": {"type": "number", "minimum": 0}
+      }
+    },
+    "notify": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "kind": {"enum": ["none"]},
+        "on": {"$ref": "#/definitions/strings"}
+      }
+    },
     "terminals": {"type": "object", "minProperties": 1, "additionalProperties": {"$ref": "#/definitions/terminal"}},
     "executors": {"type": "object", "minProperties": 1, "additionalProperties": {"$ref": "#/definitions/executor"}},
     "projects": {"type": "object", "minProperties": 1, "additionalProperties": {"$ref": "#/definitions/project"}}
@@ -101,7 +125,6 @@
       "properties": {
         "id": {"type": "string"},
         "key_prefix": {"type": "string"},
-        "webhook_secret_key": {"type": "string"},
         "states": {
           "type": "object",
           "required": ["todo", "running", "waiting", "review", "done"],