Fix push alerts after snapshot delivery failures

[cursor]

Bug and impact

Tier-B web push alerts could be sent even when the public qualified snapshot was not published to the configured relay. In that failure mode, users could receive entry/exit alerts and click through to a stale dashboard snapshot, causing significant alert/dashboard inconsistency.

Root cause

maybe_push_qualified_snapshot_relay() logged relay failures but did not return a status to the scanner. run_scanner() therefore always called maybe_notify_web_push_qualified_changes() after the snapshot block, including after snapshot write exceptions or configured relay POST failures.

Fix

• Make the scanner-side relay publish helper return a boolean delivery result.
• Gate qualified-list web push notifications on successful public snapshot delivery.
• Keep existing behavior when no snapshot relay is configured.
• Add regression tests for relay success/failure status and skipped push delivery after snapshot failure.

Validation

• python3 -m pytest tests/test_snapshot_relay_notify.py tests/test_web_push_notify.py tests/test_snapshot_relay_app.py tests/test_public_snapshot.py -q -> 24 passed
• python3 -m pytest tests/test_push_notify_filtering.py -q -> 6 passed
• python3 -m py_compile main.py scanner/snapshot_relay_notify.py scanner/web_push_notify.py tests/test_snapshot_relay_notify.py tests/test_web_push_notify.py -> passed