Validate exceptions and emit material-action notifications

[jmcte]

Problem statement

Bootstrap cannot validate policy exceptions or emit required material-action notifications and hard stops.

Desired outcome

Typed exception lifecycle and configurable notification hooks operate from the resolved contract.

Scope

• Validate rationale, scope, issue, approval, ADR, and expiry.
• Warn before expiry and fail after expiry.
• Route material notifications and block defined hard stops.

Non-goals

• Permanent exception approval automation.

Acceptance criteria

• Temporary and permanent exception rules are enforced.
• Notifications are written to governing issue/PR and configured mechanism.
• Agents continue after notification unless a hard stop applies.
• Human and JSON results use stable rule IDs.

Test expectations

Start with failing expired, incomplete, permanent-without-ADR, notification, and hard-stop fixtures.

Security implications

Notification payloads must be redacted and must not leak credentials.

Documentation implications

Add exception and notification operator guide.

Dependencies

Resolved contract issue and Flow rule IDs.

Human decision points

All exceptions; permanent exceptions require explicit approval and ADR.

[jmcte]

Reopening because the configured-mechanism acceptance criterion is not present on current main.

Evidence on fc120338c2026598852ab6ec24bf5e01c69eac3e:

• deliverMaterialAction unconditionally records configured-webhook delivery as failed with Webhook delivery is disabled until the secure transport follow-up is merged.
• PR feat: add secure webhook delivery transport #92 contained the reviewed secure transport, but it merged into an intermediate integration branch and was subsequently reverted before PR test: restore conformance warning fixture #89 reached main.
• Therefore notifications are not currently written to both the governing issue/PR and configured mechanism as required by this issue.

The previously reviewed secure transport commit has been transplanted onto a fresh branch from current main. A replacement PR will close this issue only after its exact-head tests, autoreview, CI, and independent review pass.