feat: outbound webhooks on session state transitions

[mirchaemanuel]

Summary

Adds outbound HTTP webhooks that fire on session activity state transitions. Users configure one or more endpoints in ~/.config/lazyagent/config.json with filters on event type and agent. Async best-effort delivery with optional HMAC-SHA256 signing (GitHub-style header).

• New internal/core.EventBus — first typed pub-sub in the project — published from ActivityTracker.Update whenever a session's activity changes
• New internal/webhook/ package: Dispatcher with fan-out + worker pool (4 workers), retry on 5xx/network with backoff [1s, 5s, 30s] (no retry on 4xx), 2 s dedup window for duplicate transitions emitted by multiple in-process managers (TUI + API + GUI), optional X-Lazyagent-Signature: sha256=<hex>
• Bus wired into TUI, API, and GUI tray. Tray process is forked (cross-process) so it spawns its own bus + dispatcher
• Zero behavior change when webhooks is empty / absent
• User-facing docs in docs/reference/webhooks.md with payload schema, headers, and Python HMAC verification snippet

Spec: docs/superpowers/specs/2026-05-19-outbound-webhooks-design.md
Plan: docs/superpowers/plans/2026-05-19-outbound-webhooks.md

Payload

{
  "id": "f47ac10b-...",
  "event": "state_transition",
  "session_id": "abc",
  "agent": "claude",
  "from": "idle",
  "to": "waiting",
  "project_path": "/Users/foo/code/bar",
  "timestamp": "2026-05-19T14:30:00Z",
  "api": {
    "session_url": "http://127.0.0.1:7421/api/sessions/abc",
    "detail_url": "http://127.0.0.1:7421/api/sessions/abc/full"
  }
}

api.* is included only when the API server is running (uses the resolved srv.Addr()).

Config

{
  "webhooks": [
    {
      "name": "slack-needs-input",
      "url": "https://hooks.slack.com/services/T00/B00/XXX",
      "secret": "shared-with-receiver",
      "events": ["waiting"],
      "agents": ["claude", "codex"]
    }
  ]
}

events and agents empty (or absent) mean "match everything". secret is optional — when set, requests carry an HMAC-SHA256 signature.

Design choices

• Best-effort, in-memory only — no persistence, no DLQ. Lazyagent stays read-only on disk
• Dedup at the dispatcher instead of the bus — when TUI + API + GUI run together, each manager publishes the same transition; a 2 s (session_id, from, to) window coalesces them. Stale entries are evicted opportunistically (TTL 5 min, guarded by a 64-entry threshold) so the dedup map can't grow unbounded
• One dispatcher per process — the tray forks, so its dispatcher is independent of the main process's. Documented in webhooks.md
• No SSE refactor in this PR — the existing /api/events SSE pulse is untouched. A future PR could migrate it onto the new typed bus

Test plan

• go test ./... -race passes (16 new tests across internal/core and internal/webhook)
• go build ./... and go build -tags notray ./... succeed
• Unit tests cover: bus publish/subscribe/drop/unsubscribe/concurrent, tracker transition emission, webhook config validation, payload marshal, filter matching (8 cases), HMAC test vector, dispatcher happy path / retry / no-retry-on-4xx / all-fail / HMAC header / dedup / graceful shutdown / lastSeen eviction
• Manual end-to-end smoke against a real webhook receiver (not yet performed by the author — would appreciate maintainer-side verification)

Non-goals (call-outs for reviewer)

• No CLI subcommand for managing webhooks — users edit config.json directly, consistent with the rest of the project
• No content-based or CWD-based filters in MVP. Event + agent filters cover the 90% use case
• Roadmap entry uses a placeholder version (v0.10); feel free to renumber at merge