DEVEX-1398: shared notify-ci-failure workflow (workflow_run notifier)

[pdodgen-revparts]

Summary

Adds a shared reusable workflow notify-ci-failure.yaml that posts a Slack alert (via the org SLACK_WEBHOOK_URL) describing which workflow failed on main, with commit + run links.

It's input-driven so each repo can call it from a lightweight workflow_run watcher (ci-failure-notify.yaml) that fires when ANY watched workflow (Build, PHPStan, unit tests, cs-fixer, the nightly common bump, …) concludes failure on main. This closes the silent nightly common-bump failure gap (DEVEX-1398): previously a broken bump only showed as a red ✗ in the Actions tab + an email to the bot PAT owner.

Why workflow_run (not an in-Build job)

A notify job inside Build only sees Build/deploy. The static checks (phpstan, tests, cs-fixer) run as separate workflows — their failures need a watcher that observes completed runs across the repo. One watcher per repo covers build + all checks + the bump itself.

Per-repo watcher PRs follow, each linked to DEVEX-1398.

[cursor]

PR Summary

Low Risk
CI-only addition with no runtime or app changes; risk is limited to Slack noise or mis-wiring when callers adopt the reusable workflow.

Overview
Adds a new reusable GitHub Actions workflow .github/workflows/notify-ci-failure.yaml so caller workflows can post a Slack alert when a build or deploy fails.

Callers pass workflow, run_url, and head_sha (plus optional branch and actor) and supply the org slack_webhook_url secret. A single job uses slackapi/slack-github-action@v2 with an incoming webhook payload that includes repo, workflow name, branch, actor, commit link, and a link to the failed run.

This is intended as shared plumbing for follow-up PRs that wire a final notify-failure job into per-repo Build workflows (e.g. after nightly common bumps), without changing application code.

^{Reviewed by Cursor Bugbot for commit 50ce88b. Bugbot is set up for automated code reviews on this repo. Configure here.}