fix: bump Infisical image tag and add deploy failure notification

Two fixes from the deploy pipeline audit:

1. Infisical tag v0.99.1 no longer exists on Docker Hub — bumped to
   v0.162.19 (latest available). This was silently breaking the full
   deploy pipeline (docker compose up failed on image pull).

2. Deploy failures now notify via two channels:
   - Oikos API event (deploy.failed, severity=critical) — picked up by
     the scheduler's notifier for Matrix alert
   - Matrix webhook URL if MATRIX_WEBHOOK_URL is configured
   Uses a trap with _ok flag to catch any non-zero exit path,
   including CI gate rejections and health check timeouts.
   Webhook now resolves and passes OIKOS_API_TOKEN to deploy.sh.

cmd/webhook/main.go

@@ -30,7 +30,9 @@ func main() {
 		repoDir = os.Getenv("HOME") + "/Projects/oikos"
 	}
 
-	secret := resolveWebhookHMAC(ctx)
+	// Create secrets manager once, share between HMAC resolution and deploy
+	sec := newSecrets()
+	secret := resolveWebhookHMAC(ctx, sec)
 	if secret == "" {
 		fmt.Fprintln(os.Stderr, "WEBHOOK_HMAC_SECRET must be set (env var or Infisical webhook_hmac-secret)")
 		os.Exit(1)
@@ -70,11 +72,16 @@ func main() {
 		w.Write([]byte(`{"status":"deploy started"}`))
 
 		safego.Go("webhook:deploy", func() {
+			apiToken := ""
+			if sec != nil {
+				apiToken = secrets.ResolveSecret(ctx, sec, "api_token", "")
+			}
 			cmd := exec.Command(repoDir + "/scripts/deploy.sh")
 			cmd.Dir = repoDir
 			cmd.Env = append(os.Environ(),
 				"REPO_DIR="+repoDir,
 				"PROFILE=full",
+				"OIKOS_API_TOKEN="+apiToken,
 			)
 			cmd.Stdout = os.Stdout
 			cmd.Stderr = os.Stderr
@@ -99,10 +106,9 @@ func main() {
 	}
 }
 
-// resolveWebhookHMAC fetches the webhook HMAC secret from Infisical,
-// falling back to the WEBHOOK_HMAC_SECRET env var.
-func resolveWebhookHMAC(ctx context.Context) string {
-	sec := secrets.NewManagerFromConfig(
+// newSecrets creates the Infisical secrets manager from env vars.
+func newSecrets() *secrets.Manager {
+	return secrets.NewManagerFromConfig(
 		os.Getenv("OIKOS_INFISICAL_SITE_URL"),
 		os.Getenv("OIKOS_INFISICAL_CLIENT_ID"),
 		os.Getenv("OIKOS_INFISICAL_CLIENT_SECRET"),
@@ -110,6 +116,14 @@ func resolveWebhookHMAC(ctx context.Context) string {
 		os.Getenv("OIKOS_INFISICAL_ENV"),
 		os.Getenv("OIKOS_SECRETS_DIR"),
 	)
-	envFallback := os.Getenv("WEBHOOK_HMAC_SECRET")
-	return secrets.ResolveSecret(ctx, sec, "webhook_hmac-secret", envFallback)
 }
+
+// resolveWebhookHMAC fetches the webhook HMAC secret from Infisical,
+// falling back to the WEBHOOK_HMAC_SECRET env var.
+func resolveWebhookHMAC(ctx context.Context, sec *secrets.Manager) string {
+	envFallback := os.Getenv("WEBHOOK_HMAC_SECRET")
+	if sec == nil {
+		return envFallback
+	}
+	return secrets.ResolveSecret(ctx, sec, "webhook_hmac-secret", envFallback)
+}