refactor(alerts): drop fetch from AlertRuntime, use the runtime HttpClient - #1261

🟢 Confidence 4/5 · likely safe to merge
Every production hunk is a semantics-preserving swap of the raw fetch for the ambient client, and all call sites and fake-fetch wirings were updated together.
_{quality 100/100 · no findings · tests covered · risk low · 2/3 new units observable}

Removes the raw fetch from AlertRuntime and routes alert delivery, Telegram verification and the PagerDuty key check through the runtime HttpClient (fake wire injected as FetchHttpClient.Fetch). The refactor is equivalent in behavior; nothing here needs changing before merge.

• dispatchDelivery and TransportRuntime drop fetchFn; delivery uses the ambient HttpClient
• telegramGet replaces raw fetch and suppresses the client span for the token-bearing URL
• verifyPagerDutyRoutingKey posts via HttpClientRequest/HttpClient.execute
• AlertRuntimeApi loses fetch; tests inject FetchHttpClient.Fetch instead

_{1b9274f · Updated on every push. Reply "won't fix" to dismiss a finding, or mention @maple-review-bot to ask about one.}