feat: add discord alerting for dependabot pull requests

[xnoto]

What

Grafana-side of the Dependabot PR alerting pipeline, fully managed as code via grafana-operator CRs:

File	Purpose
contactpoint-discord.yaml	GrafanaContactPoint (discord); webhook URL resolved from SOPS-encrypted discord-webhook Secret via valuesFrom (key token, matches .sops.yaml encrypted_regex)
notificationpolicy.yaml	GrafanaNotificationPolicy — root route → discord. Owns the entire policy tree; extend route.routes for future alert sources
serviceaccount-alerts.yaml	GrafanaServiceAccount (github-actions-alerts, Editor); operator mints the token into the grafana-alerts-token Secret (key token)
discord-webhook-secret.yaml	SOPS-encrypted webhook URL (encrypt-only with repo age key)
kustomization.yaml, ksops-grafana-secrets.yaml	wiring

After sync

Copy the generated token into tfroot-github/secrets/secrets.yaml as grafana_alerts_token (needed by the stacked tfroot-github PR):

kubectl --context k3s -n grafana get secret grafana-alerts-token -o jsonpath='{.data.token}' | base64 -d

If alert POSTs return 403, recreate the service account CR with role: Admin.

Merge order

Second, after shared-workflows#14. ArgoCD syncs on merge; contact point/policy/service account appear in Grafana automatically.

Validation

• pre-commit run: check-yaml, kube-linter, gitleaks pass.
• CRD shapes verified against grafana-operator v5.24.0 (the deployed version) examples and controller source.
• kustomize build not run locally: the ksops generator requires the age private key; ArgoCD performs the build with its own key.