Webhook receiver: Plane deliveries trigger a tick (PAD-7)

agentd webhook-serve (agentd/webhook.py, stdlib): verifies X-Plane-Signature
(HMAC-SHA256 hex of the body, constant-time; 401 on missing/bad), routes by
data.project to a configured tenant (others 202), coalesces deliveries within
3 s into one tick, runs one more tick when deliveries arrive during a tick,
and retries every 15 s for up to 2 min while the lock is held (tick command
exit 75: flock -E 75 in the cron scripts, cli tick on Busy). Ticks run in a
systemd scope so restarting the receiver never kills one. Log:
<log_dir>/webhook.log; GET /healthz.

Config: webhook section (key names only, PLANE_WEBHOOK_SECRET scrubbed from
child envs like the Plane tokens), notify: {kind: none} as a no-op hook
called on every state move; the unused per-project webhook_secret_key is
gone (Plane webhooks are workspace-level). systemd unit for the LXC and
tools/plane-webhook.py to create/rotate the Plane webhook as the workspace
admin (secret straight into the Vault, never printed).

tests/test_transports.py

@@ -38,7 +38,7 @@ class LocalSecretsTest(unittest.TestCase):
             data = config_data()
             data["agentd"]["state_dir"] = str(Path(tmp) / "state")
             data["terminals"]["oregon"]["repo"] = tmp
-            data["projects"]["GWENT"]["webhook_secret_key"] = "HOOK_GW"
+            data["webhook"] = {"secret_key": "HOOK_GW", "tick_command": ["true"]}
             cfg = Config(data)
             self.assertEqual(cfg.secret_keys(), {"TOK_OR", "TOK_W10", "HOOK_GW"})
             t = LocalTransport(cfg, "oregon")