"""External webhook egress — ship bus events to SIEM/SOAR stacks."""