feat: SLOs & uptime reports, status-page incident publications, PagerDuty (replaces Opsgenie), remote-CDP browser checks, SMTP send-mode

[fclairamb]

Summary

A large batch branch (batch/2026-08-17) landing ~30 audited specs. Highlights, grouped:

New capabilities

• Service Level Objectives — define an SLO over a check or group with a rolling or calendar window; status, error budget and a per-step burn-down chart. DST-safe calendar math, maintenance tagged at ingest so planned downtime never eats the budget, maxSlos entitlement, full dash0 list/detail/edit pages and an SLO coverage chip.
• Scheduled uptime reports — recurring email digest attached to an SLO: schedule CRUD, test send, delivery job, email template with List-Unsubscribe headers and per-recipient links.
• Status-page incident publications — a first-class editable overlay on top of a check incident: manual publish/unpublish or page-level auto-publish with a debounce and per-resource override, resolve/relapse sync, subscriber fan-out, webhook events. status0 renders active publications, a severity banner, affected-component badges and a collapsible history; dash0 gets page settings, the publish block and a dedicated editor route. Also exposed via MCP.
• Incident failure diagnostics — opt-in capture of the failing HTTP response, persisted on incident open/reopen, shown as a "What the probe saw" card. Carried on a dedicated Diagnostics channel and kept out of the assertion body so enabling it cannot move a verdict.
• PagerDuty (Events API v2) replaces Opsgenie across backend, dashboard and docs.
• Matrix as an org-level notification integration.
• Remote-CDP browser checks — checkers.browser.cdp_url / chrome_path, concurrency cap, a per-region browser capability reported by workers, a creation-time warning when a region has no headless Chrome, surfaced under the region picker.
• Send-mode SMTP checks — submit a real probe email and pair it with delivery.
• Change password from the dashboard — authenticated POST /api/v1/auth/change-password plus a Password card on the account security page.
• Agent build versions — reported over the wire, stored, surfaced in AgentResponse and flagged on drift; long-revoked agents are purged by agent_gc and a second DELETE purges immediately.

Reliability & observability

• Migration integrity guard — catches migrations whose content changed after being recorded as applied (the failure that silently skipped 013 and left workers.capabilities missing). warn mode, a self-healing 014, and a solidping migrate repair CLI.
• Abandoned result status — abandoned probes are reaped into a dedicated status, excluded from availability, declared in OpenAPI and rendered neutrally.
• Slow-query WARNs with a callsite label, a results row-count gauge, db.slow_query_threshold (default 500ms).
• Sentry — 5xx reporting from the handler error funnel, check/job panic tags, the recovery middleware the panic path was re-panicking into (mounted inside the request timeout), environment defaulted to the run mode, SP_SENTRY_TRACES_SAMPLE_RATE bound.

Performance

• Per-check availability fans out with a bounded errgroup instead of a serial loop (~8s → parallel).
• Incidents list N+1 removed: member enrichment opt-in via with=members, the rest batched into ≤3 queries per page.
• Uptime bar split into tier-aligned raw and rollup queries, raw retention resolved from live performance parameters.

Fixes

mail_from SMTP/header-injection hole closed · auto-slug races on create/clone · JSONPath assertions with no body matcher · notification route/contact deletion + dangling-route cleanup · SQLite post-006 unique index across the 016 rebuild · results list with=checkSlug,checkName join · status0 availability-bar tooltip staleness · 2FA temp token as a Bearer header · blast-radius UUIDs/overflow · duplicate empty-state CTAs.

BREAKING CHANGE: Opsgenie is removed — migration 015 hard-deletes existing Opsgenie integrations on upgrade; recreate them as PagerDuty integrations using an Events API v2 routing key.

BREAKING CHANGE: the results list endpoint no longer returns pagination.total, nextCursor or hasMore — they were never populated with real values.

Test plan

• make test — backend suite green
• make lint — backend + dash lint clean (no new errors in touched files)
• make test-dash — dash0 Playwright E2E green
• Each spec independently audited for completeness before archiving; negatives covered with positive controls (storm-cap and leak tests, concurrency pinned by a counting barrier rather than wall-clock)