## Why

The transport-independent notification API already exposes a bound Discord service, but its valid-message path is still a stub. Completing synchronous Discord incoming-webhook delivery makes that service usable without exposing Discord details to consumers.

## What Changes

- Replace the Discord stub with synchronous JSON webhook delivery through the existing bound notification-service API.
- Require a structurally valid canonical Discord webhook URI and a positive caller-supplied timeout at construction.
- Validate messages, preserve their content exactly, use `wait=true`, and report delivery failures through `IOException` without retrying.
- Protect webhook credentials from diagnostics and disable redirect following.

## Capabilities

### New Capabilities

None.

### Modified Capabilities

- `notification-services`: Replaces the unimplemented Discord-delivery requirement with fully bound synchronous webhook-delivery, validation, response, interruption, and secret-protection behavior.

## Impact

Only `DiscordNotificationService` and the active OpenSpec change are affected. The existing Jackson dependency is reused. No composition-root wiring, other notification transport, or test code changes.
