Swap webhook Ingress for a NodePort service

No new A record could be added for a dedicated webhook host, so expose
Flux's webhook-receiver directly via NodePort instead of going through
Traefik/Ingress/DNS - same approach the deliveries LoadBalancer already
uses on 30662.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

clusters/production/webhook-service-nodeport.yaml

@@ -0,0 +1,19 @@
+# Exposes Flux's webhook-receiver directly via NodePort, bypassing
+# Traefik/Ingress/DNS entirely - no A record needed. Selector matches the
+# notification-controller pod labels from Flux's own bundled manifests; if
+# `kubectl get endpoints webhook-receiver-external -n flux-system` comes up
+# empty after this applies, check the pod's real labels with
+# `kubectl get pods -n flux-system --show-labels` and fix the selector below.
+apiVersion: v1
+kind: Service
+metadata:
+  name: webhook-receiver-external
+  namespace: flux-system
+spec:
+  type: NodePort
+  selector:
+    app: notification-controller
+  ports:
+  - port: 80
+    targetPort: 9292
+    protocol: TCP