Do Webhook Subscribe

2026-08-07 audit: every /do response has advertised 'POST /do/webhook to subscribe' since the magnet was built, but the route never existed - agents following the instruction hit the 302 catch-all. A promised-but-absent capability violates the truth law, so the route now exists for real. Ownership = the per-task client_key from the /do tracking link. Delivery: scripts/task_webhook_notifier.py (timer) POSTs {task_id,status} on every status change. SSRF guard: only public http(s) hosts - an agent-supplied URL must never let the organism call its own internal ports.