feat(notifications): Slice 3 — governance action queue (RBAC-scoped)

[remyluslosius]

Summary

Notifications Slice 3 (per the change-driven design §3/§7/§9): turn the bell into an action queue. Where Slice 1 (alerts) and Slice 2 (rule regressions) fan to every active user, governance items route only to the users who can act on them.

New primitives (the RBAC-scoped fan-out Slice 3 needed)

• auth.RolesWithPermission(p) — resolves a permission to the built-in roles that grant it (pure function over BuiltInRoles).
• notifyfeed.Store.RecordForRoles — fans one row per active user holding any of the given roles (EXISTS, so a user with two matching roles still gets one row; avoids an ON CONFLICT double-hit), with the same upsert/collapse/re-surface semantics as RecordFanout.

Producer: notifyfeed.GovernanceProjector

Event	Recipients	kind / severity	Link
Exception requested	roles granting exception:approve (auditor, security_admin, admin)	exception_pending / high	/settings/policies
Exception approved/rejected	the requester only	exception_approved / _rejected, medium	/settings/policies
Remediation failed / rollback didn't restore	roles granting remediation:execute (ops_lead, security_admin, admin)	remediation_failed / high	/hosts/{id}

Grouping: exceptions per exception id, remediation per (host, rule). A successful user-initiated rollback is not notified — it's the intended outcome, and alarming on it would violate the design's "noise is a bug" principle (§7).

Producer hooks (best-effort, nil-safe, never fail the transition/job)

• exception.Service.WithNotifier(...) + calls in Request/Approve/Reject.
• worker.RemediationWorker GovernanceNotifier + calls on the two terminal-failure sites (execute→failed, rollback-not-clean).
• Wired in both boot paths: cmd/openwatch/main.go (serve) and worker.go (dedicated worker).

Both producers hold the interface in their own package, so neither imports notifyfeed (the projector satisfies them structurally).

Spec & tests

• system-notifications v1.5.0: C-08 + AC-15/16/17. specter check green (114 specs); annotation coverage = system-notifications 17/17 ACs, 100%.
• auth.RolesWithPermission unit test (which caught my own wrong assumption — exception:approve includes auditor, confirming the projector notifies auditors); DB-backed governance fan-out tests proving approver-scoped / requester-only / operator-scoped routing and that out-of-scope roles receive nothing.

Scope notes

• No frontend change — new rows render in the existing Slice-1 bell drawer.
• Exception expiring-soon (design §3) and info-level digests / batched good-news are Slice 4, deferred.

🤖 Generated with Claude Code