Swap webhook Ingress for a NodePort service

No new A record could be added for a dedicated webhook host, so expose
Flux's webhook-receiver directly via NodePort instead of going through
Traefik/Ingress/DNS - same approach the deliveries LoadBalancer already
uses on 30662.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

clusters/production/webhook-ingress.yaml

@@ -1,23 +0,0 @@
-# Dedicated host so this never shares a routing table with
-# queue.workolik.com, which already has a Gateway + Ingress conflict history.
-# Requires a DNS A record for flux-webhook.workolik.com pointing at the same
-# LB IP the other *.workolik.com hosts use.
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: flux-webhook-ingress
-  namespace: flux-system
-  annotations:
-    traefik.ingress.kubernetes.io/router.tls: "true"
-spec:
-  rules:
-  - host: flux-webhook.workolik.com
-    http:
-      paths:
-      - path: /hook
-        pathType: Prefix
-        backend:
-          service:
-            name: webhook-receiver
-            port:
-              number: 80

clusters/production/webhook-service-nodeport.yaml

@@ -0,0 +1,19 @@
+# Exposes Flux's webhook-receiver directly via NodePort, bypassing
+# Traefik/Ingress/DNS entirely - no A record needed. Selector matches the
+# notification-controller pod labels from Flux's own bundled manifests; if
+# `kubectl get endpoints webhook-receiver-external -n flux-system` comes up
+# empty after this applies, check the pod's real labels with
+# `kubectl get pods -n flux-system --show-labels` and fix the selector below.
+apiVersion: v1
+kind: Service
+metadata:
+  name: webhook-receiver-external
+  namespace: flux-system
+spec:
+  type: NodePort
+  selector:
+    app: notification-controller
+  ports:
+  - port: 80
+    targetPort: 9292
+    protocol: TCP