[recipes] Add brain-health-monitor: cron observability + critical-only Slack paging

[eazene]

What

New recipe: an hourly ops probe that makes cron→function outcomes observable and pages Slack only when something is actually wrong.

The problem it solves

cron.job_run_details records succeeded when pg_net queued the HTTP request — not when your Edge Function returned 2xx. A scheduled function can fail every run for weeks while cron shows green. Observed live: a run whose function returned {"succeeded":0,"failed":2} was logged succeeded.

How

• schema.sql — ops_http_post_logged() wrapper stores the pg_net request id of every scheduled call; ops_harvest_responses() copies outcomes out of net._http_response before pg_net purges it; ops_cron_http_failures joins them back deterministically (bad status / "ok":false body / no response after grace). Plus alert-state (24h per-alert page cooldown), health snapshots, and a bounded retention purge.
• monitor/index.ts — hourly Edge Function: harvest → checks → page on breach → weekly all-green heartbeat (dead-man switch: breach pages within the hour, health heartbeats weekly, missing heartbeat = the monitor itself is dead — every state has a distinguishable signal) → snapshot.
• Checks degrade gracefully: entity-queue poison (needs entity-extraction schema), fingerprint/entity-dedup regressions (needs editorial-policy hygiene.sql — pairs with [recipes] editorial-policy: add mechanical hygiene block to the auditor #439), and backup staleness (opt-in via a _backup_receipt row) all skip cleanly when their dependency is absent. A stock install still gets cron-failure + embedding-gap coverage.
• schedule.sql includes the migration template for existing jobs and a documented forced-failure drill — prove the pager works, don't trust theory.

Provenance

Running in production for a live brain; the drill paged correctly against a manufactured 404, and the heartbeat proved the green path. Vault-header auth throughout (no ?key= URLs — pairs with #437).

🤖 Generated with Claude Code

[github-actions]

OB1 PR Gate

✅ Folder structure — All files are in allowed directories
✅ Required files — README.md and metadata.json found in all contribution folders
✅ Metadata valid — All metadata.json files passed JSON Schema validation
✅ No credentials — No API keys, tokens, or secrets detected
✅ SQL safety — No destructive SQL or core table modifications
✅ Category artifacts — Required file types present for each category
✅ PR format — Title follows [category] Description format
✅ No binary blobs — No oversized or binary files
✅ README completeness — All READMEs include Prerequisites, Steps, and Expected Outcome
✅ Contribution dependencies — All declared skill and primitive dependencies exist and are linked in README
✅ LLM clarity review — Covered by Claude PR Review workflow
✅ Remote MCP pattern — No local MCP server patterns detected — uses remote MCP correctly
✅ Tool audit link — Extensions/integrations link to the MCP Tool Audit guide
✅ Scope check — All changes are within the contribution folder(s)
✅ Internal links — All relative links in READMEs resolve to existing files

Result: All 15 checks passed! Ready for human review.

---

Post-Merge Tasks

These don't block merge — they're reminders for admins after this PR lands.

• Add Brain Health Monitor to recipes/README.md
• Add Brain Health Monitor to root README.md community contributions section
• Add Ezana Azene (@eazene) to CONTRIBUTORS.md
• Post in OB1 Discord #show-and-tell