mathias
1ff6af4a40
buildNotifier returns a nil interface when BRAIN_NTFY_URL is unset, and every consumer skips a nil notifier silently. That is right for an unconfigured homelab and wrong for an alert whose entire value is that someone finds out: "configured and working" and "never configured" were byte-identical in behaviour — no error, no warning, only a message that never arrives, which nobody notices because nobody is waiting for an alert they have never seen. Two alerts were dark in production for exactly that reason (#100): the governance-rewrite alert from #97, and the audit-degradation alert that reports the audit trail is down. Both were found by firing a real event and watching nothing happen, not by reading anything. WARN rather than fatal, deliberately. The brain rule `empty-credential-must-refuse-to-start-not-switch-modes` says an empty credential must be a startup error rather than a silent mode switch — but that is about a control being removed. Here observability degrades, no gate is bypassed, and refusing to boot would break the unconfigured-homelab case the nil notifier exists to support. What that rule demands and this provides is that the mode switch stops being silent. buildAuditSink already announces its own fallback ("capture audit: slog sink (BRAIN_LOKI_URL unset)"), so only the notifier needed this. alertingWarnings is pure and env-injected: the reason this gap survived is that nothing about it was observable, so the fix is tested rather than asserted. Refs #107, #100, #97.