feat: add healthchecks.io pings to run-stories.sh and run-profiles.sh

Start/finish pings wired through gdl-cron.sh via HC_URL, finish ping
carries the run's log as its body (visible in the dashboard, no SSH
needed to diagnose a failure). Exit code is the trailing URL segment
by convention, so the existing "stories: 0 to sync" -> exit 75 remap
already reaches the dashboard as a failure too.

Also fixes the actual bug that would have made this useless: the
routine chown-permission rsync warning (the archive share is never
owned by the ssh user) made gdl-sync.py return 1 on every clean run,
not just failing ones -- harmless when a human reads the log, but it
would have pinged every successful run as a failure. publish() now
only masks that one specific, verified-benign error shape; a real
transfer failure sharing the same exit code (23) still fails loudly.
6 new tests.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_011qAds5qr7nZRq5R4yAuxUk

TOOLING.md

@@ -159,6 +159,32 @@ files, it is host-local runtime config, and it embeds the same real
 Chrome-profile path already documented above. Recreate it by hand (or from
 this section) after a fresh `mattellite` setup.
 
+## Healthchecks.io
+
+`run-stories.sh` and `run-profiles.sh` each ping a healthchecks.io check —
+`instagram-archiver-stories` / `instagram-archiver-posts` — via `HC_URL`,
+plumbed through to `gdl-cron.sh`. A start ping fires before the sync, a
+finish ping fires after with the run's own log attached as the body (visible
+in the healthchecks.io dashboard, so a failure is diagnosable without SSHing
+in). The trailing URL segment is the exit code: `0` means success, anything
+else fails the check — including the `stories: 0 to sync` → exit 75 remap
+above, so a fully-skipped stories run alerts, not silently passes.
+
+Unset `HC_URL` (e.g. `HC_URL= ./run-stories.sh`) to run without pinging.
+`run-full-sweep.sh` and the reels scripts have no check configured yet.
+
+**This is also why `gdl-sync.py`'s `publish()` no longer treats the routine
+chown-permission warning as a failure (2026-09-14).** The archive share is
+never owned by the ssh user, so rsync's own `chown` step fails on *every*
+run — exit 23, "some files/attrs were not transferred" — even though every
+file lands; "Reading the output" above has documented this as cosmetic since
+this file was created. Before this fix the exit *code* didn't know that, so
+`gdl-sync.py` returned 1 on every clean run too — harmless when a human was
+reading the log anyway, but it would have made every healthcheck ping report
+a normal run as a failure. Only that specific permission-warning shape is
+masked; a real transfer failure sharing the same exit code (23) still fails
+loudly, verified with both a real captured rsync failure and unit tests.
+
 ## Remotes
 
 | remote | what goes there |