ci: post release failures to #bot-patchwave in Slack

[blimmer]

Summary

The release workflow was silent on failure. The 0.7.0 release failed Apple notarization on two attempts — a 403 FORBIDDEN.REQUIRED_AGREEMENTS_MISSING_OR_EXPIRED (an expired Apple Developer agreement, which needs a human to re-accept) — and nobody was alerted until a user hit the stale patchwave.ai/analyze.sh installer and reported the 404. This adds a notify-failure job that assumes the release role via OIDC and publishes an AWS Chatbot custom notification to the shared cb-notifications-bot-patchwave SNS topic whenever the pipeline fails (including the test gate). Closes PW-48.

Depends on contextbridge/patchwave#90, which grants the release role sns:Publish on that topic — deploy that first, or the publish call will be denied.

Review focus

• The job derives the AWS account from sts get-caller-identity and builds the topic ARN from the stable cb-notifications-bot-patchwave name, so no account id is hard-coded in the workflow. Preferable to a hard-coded ARN or a new secret, I think — but open to either.
• if: ${{ failure() }} with needs: [test, release] fires on any pipeline failure but deliberately not on cancellation. It also fires per failed run/attempt, which is the intent — silence was the whole bug.
• Least privilege: the job requests only id-token: write and uses configure-aws-credentials directly (not the fetch-release-secrets composite), so the alert path doesn't depend on the signing-secret reads that can themselves fail.

Commits

• 658bfbb — ci: post release failures to #bot-patchwave in Slack