Fire an automation with a signed request

Fires an automation from your own stack (Zapier, GitHub Actions, an internal cron). The agent answers in a real thread your team can join, with the same approval gate as any other run — a proposed action still waits for a human. Authentication is a per-automation HMAC, not an API key: send `x-rk1-trigger-signature: t=<unix-seconds>,v1=<hex hmac-sha256("<t>.<raw body>", secret)>`. The secret is shown once when the automation is created and can be rotated. Requests more than 5 minutes old are rejected. Body: `{}` or `{ "input": <json ≤ 8 KiB> }`, which is rendered into the message the agent receives. A run already live in the automation’s thread answers `busy` (the slot is skipped, never duplicated); one parked on an approval answers `needs_input`.