updater: fix webhook secret template (backtick literal, not escaped quotes)

The -template parser is Go text/template; JSON-escaped \" broke the action.
Backtick raw-string literal is valid inside the JSON string and parses cleanly.
Config-only (mounted + hotreload) — no app rebuild.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

updater/hooks.json

@@ -7,7 +7,7 @@
     "trigger-rule": {
       "match": {
         "type": "value",
-        "value": "{{ getenv \"UPDATER_SECRET\" }}",
+        "value": "{{ getenv `UPDATER_SECRET` }}",
         "parameter": { "source": "header", "name": "X-Update-Token" }
       }
     }