scrub slack webhook and grafana URL from public repo

[Flotapponnier]

Audit finding: harnesses/metadata-coverage/ had a live Slack-bridge webhook URL hardcoded in 3 alertmanager.yml files, plus a public Grafana dashboard URL in the README. If the agent-slack service has no auth, anyone reading the repo can spam the monitoring channel.

This PR:

• Replaces the webhook URL with https://example.invalid/your-slack-webhook + a comment pointing to an envsubst-based deploy pattern.
• Removes the live Grafana link from the README (local-host instructions already documented below).

Action required after merge (not blocked by this PR):

• Rotate the Slack-bridge webhook URL on Railway. The original URL is still in git history (and now publicly known); rotation neutralizes the leak without needing a second history rewrite.
• If you keep the same Railway service, just regenerate the path component (/webhook/grafana → /webhook/<new-random>).