Add policy-based alerting for failures, latency, and SSL expiry

Normalized profile

What this task asks for

Add policy-driven alerting with consecutive failure, latency, recovery, and SSL expiry notifications. While a target remains degraded, every later slow check should produce `target_degraded`. Suppression affects delivery, not evaluation: `Decision` must still report the state change and set `Suppressed=true`. Each evaluation should return a current snapshot: `State`, `PreviousState`, `ConsecutiveFailures`, `ConsecutiveRecoveries`, `LatencyBreaches`, and `SSLDaysRemaining` should match tracker state even when `Event == EventNone` or `Suppressed == true`. `alerts.NewTracker(Policy)` must return a tracker with `Evaluate(Check, time.Time) Decision`. `HandleWebhookDecisionWithHeaders` must preserve custom headers. Decision webhook helpers must not send when `decision.Event == EventNone` or `decision.Suppressed == true`.