discord is a real output, but today it's a workflow step with a raw webhook url pasted into the editor. there's no good place to set it up, the url sits in workflow data, and it's per workflow instead of per org. ripped out for now; this tracks bringing it back properly.
what we want
- a tripwire discord bot maintainers add to their server (oauth install, like the github app)
- connected once per org in settings > connections; pick the channel there
- workflows reference the connection ("notify discord") instead of holding a webhook url
- messages follow the same redaction policy as other surfaces (the webhook surface today)
- members-only on the run page, never linked publicly
open questions
- one channel per org or per repo
- which events: blocked only, human review needed, every verdict
- slash commands later (approve / block from discord) or notify-only first
- do we keep a generic outbound webhook for other tools
context
- removed from the workflow catalog and run page in the discord rip-out pr
- existing stored workflows with a discord step keep parsing; lint asks to delete the step