Add notifier driver: `webhook` (generic HTTP POST with template body)

Built-in drivers cover the common destinations (`desktop`, `slack`, `imessage`, `ntfy`, `pushover`), but every shop has at least one bespoke HTTP service that wants to receive notifications: PagerDuty, OpsGenie, an internal incident bot, a custom Lambda. Today the only way to hit one of those is the plugin escape hatch (`driver = "plugin"`), which means a separate binary just to POST JSON.

## Proposal

A new in-process driver `webhook` that does a generic HTTP POST with a configurable body template.

Manifest shape:

```toml
[[notifiers]]
driver = "webhook"
url = "https://hooks.example.com/dotagent"
method = "POST" # default POST; PUT/PATCH allowed
headers = { Authorization = "Bearer ${TOKEN}", "Content-Type" = "application/json" }
body_template = """
{
"agent": "{{agent}}",
"schedule": "{{schedule}}",
"event": "{{event}}",
"exit_code": {{exit_code}},
"stderr_tail": {{stderr_tail_json}}
}
"""
```

Variables available in the template: `agent`, `schedule`, `event`, `exit_code`, `duration_seconds`, `stdout_tail`, `stderr_tail`, `stdout_tail_json`, `stderr_tail_json`, `timestamp`.

## Acceptance criteria

- [ ] POSTs the rendered body with the configured headers and method.
- [ ] Template variables are correctly interpolated; missing variables produce a clear validation error.
- [ ] `_json` suffix produces a JSON-string-encoded version of the value (so embedding multiline stderr inside a JSON template just works).
- [ ] Failure to POST does NOT crash the daemon; logs the error and moves on.
- [ ] Env interpolation in `headers` works (`${TOKEN}`).
- [ ] Respects `[security]` `network` allow-list.

## Where to start

- `crates/dotagent-notify/src/ntfy.rs` — closest analogue (already POSTs a body).
- `crates/dotagent-notify/src/lib.rs` — driver registration + shared HTTP client.

## Non-goals

- Templating beyond simple `{{var}}` substitution (no Handlebars, no Tera). Keep it tiny.
- Signing the body (HMAC, JWS). Future driver `webhook-signed` if needed.

Start with crates/dotagent-notify/src/ntfy.rs for the existing POST flow, then read crates/dotagent-notify/src/lib.rs for driver registration and the shared HTTP client. Trace how security network allow-lists and notifier errors are handled. Done means the webhook driver supports the listed methods, headers, environment interpolation, template variables, JSON-suffixed values, failure logging, and allow-list enforcement.

Written by the indexing model from the issue text.