feat(spine): Vapron-parity — Slack-compatible paging, mutual watch, exclusion rot rule #5521

Three of the Vapron briefing's four asks (#2 ships separately as systemd config)

1. Paging channel works with Slack now. Their "verify this" was warranted — the fanout was already webhook-first (built 2026-08-19), but the payload lacked Slack's required text field: pointing MONITOR_ALERT_WEBHOOK_URL at a Slack incoming webhook would have silently 400'd every page. Fixed; ntfy/Pushover behavior unchanged.
2. Mutual watch formalized. PEER_WATCH_URL adds a peer:watch synthetic check probing the peer's absolute URL every monitor tick — up/down rides the existing transition alerting, incident log, and paging webhook, so a dead vapron.ai pages exactly like a dead gluecron.com. (Absolute check URLs now probe as-is; the runner always base-prefixed before.) Off when unset — generic self-hosters have no peer.
3. Exclusion rot rule adopted. New exclusion-rot.test.ts: every ci-test-excludes.txt entry must name a test file that still exists, actually be a test file, and the list must carry reasons — a stale exclusion fails the suite instead of aging into false-negative blindness. The selfcheck engine already enforced this for selfcheck-ignore markers; this extends the principle to the biggest remaining skip list.

Owner wiring after merge (on 161, /opt/gluecron/.env + container recreate): MONITOR_ALERT_WEBHOOK_URL=<Slack webhook or ntfy topic> and PEER_WATCH_URL=https://vapron.ai/.

Tests: 4 new peer-watch/text tests, 3 rot tests, fanout suite 6/6, env-drift green, typecheck clean.

🤖 Generated with Claude Code