feat(monitoring): scope incidents to an environment

[dannash100]

A group is one incident target, so a test box going down paged the site like its production central, and production trouble arriving mid-incident joined the test one.

• incidents.rank: a target is one of a group's environments, the group, or Canopy. Open-incident uniqueness splits per environment.
• An unranked application, and a box hosting nothing ranked, target the group.
• Channel and delays stay per group: one webhook per workflow, so per-environment routing has nowhere to go.
• Slack names production as the bare group name, so it reads as today. A group's own incident is indistinguishable there; the UI distinguishes.

#528 owns the environment window. Open incidents self-heal.