STAC-25461 Drop SLACK_CI_REPORT_CHANNEL from the Cerberus notify path

[LouisParkin]

Removes the Slack channel from the Cerberus notification payload. It was never doing anything, and dropping it halves what pulumi-infra has to provision for this repo.

Why

@fzhdanov flagged in Slack that SLACK_CHANNEL_ID is no longer needed because the Lambda already runs with it. I verified that against the Cerberus source. internal/router/route/notify.go resolves the channel as:

Channel: util.GetOrDefault(req.Context, "channel", s.Channel)

and util.GetOrDefault (internal/util/context.go:27) treats an empty or whitespace value as absent:

if v, ok := c[key]; ok && strings.TrimSpace(v) != "" {
    return v
}
return defaultValue

This repo does not hold SLACK_CI_REPORT_CHANNEL, so ${{ secrets.SLACK_CI_REPORT_CHANNEL }} was expanding to an empty string and every call was already sending channel: "" and hitting that fallback. The field was inert.

What changed

cerberus-notify.yml:

• dropped the SLACK_CI_REPORT_CHANNEL entry from workflow_call.secrets
• dropped the SLACK_CHANNEL env var, the --arg channel binding, and the channel: payload field
• the key is now omitted rather than sent empty. GetOrDefault makes the two equivalent, but omitting it states the intent
• comment records how to reintroduce it if agent failures should ever go somewhere other than the shared CI channel

The three callers (lint-and-unit-tests.yml, build-binaries.yml, build-deb.yml) no longer pass the secret.

Knock-on effect

StackVista/pulumi-infra#258 now asks for a single value, CERBERUS_LAMBDA_URL, instead of two. That matters here because org-level secrets default to visibility: private, which in GitHub means private repos only — and stackstate-agent is public, so it cannot see the org-level copies. Fewer repo-level values is a smaller ask and a smaller surface.

Validation

• actionlint — clean apart from the pre-existing unknown-runner-label warnings for our self-hosted labels (docker-public, xlarge-public, arm64-xlarge-public)
• zizmor --collect=workflows,actions,dependabot . — No findings to report
• the jq invocation still emits valid JSON in the shape Cerberus expects:

{"action":"notify","context":{"platform":"github","project.id":"StackVista/stackstate-agent","project.slug":"StackVista/stackstate-agent","project.name":"StackState Agent","branch":"stackstate-7.78.2","pipeline":"123","commit.sha":"abc","commit.title":"STAC-1 fix","suite":"unit-tests"}}

No CI behaviour changes: the notify job still only runs on push when a needed job failed, and still exits 0 with a warning annotation while CERBERUS_LAMBDA_URL is absent.

Targets STAC-25142-agent-lint-unit (the #444 integration branch), not master.

Jira: https://stackstate.atlassian.net/browse/STAC-25461