feat(s52): export Notifier public contract + sync extending.md B11

docs/extending.md

@@ -117,8 +117,15 @@ territory for a deployer, with the seam named:
   layers (`write_verdict`, `promote_verdict`) are last-write-wins per file. The full taxonomy
   (rejection categories + a rule for conflicting expert verdicts) is deferred until real experts
   produce conflicting verdicts.
-- **B11 — expert notification.** `run_project(notify=...)` is a stub seam (`run.py`): pass any
-  callable; no delivery mechanism (e-mail/Teams/webhook) ships with the core.
+- **B11 — expert notification.** `run_project(notify=...)` remains a plain-callable seam
+  (`run.py` auto-wires no default notifier), but the core now ships the declared `Notifier`
+  contract (`notify.py`, exported from the package top) with three implementations:
+  `ConsoleNotifier`, `FileNotifier` (byte-deterministic JSONL), and `WebhookNotifier` — plus a
+  fail-fast `build_notifier(config, *, allow_egress=...)` factory. The webhook is the ONLY egress
+  point and is fail-closed behind an explicit per-run `allow_egress=True` opt-in (a code kwarg,
+  never a config field — mirroring the ingest layer's `allow_network`). SSRF guards, HMAC
+  signing, and auth headers remain deployer-owned extension points on the injectable
+  `WebhookPost` transport seam.
 - **U12 — checkpointing / crash-survival of a run.** A run either completes or is re-run; the
   async verdict inbox (step 7) is the resumable boundary, not intra-run state.
 - **U14 — OpenTelemetry / observability.** Provenance stamping is the audit trail the core