ci: send the Slack payload as JSON with a literal-newline message

slack-github-action v4 ships js-yaml v5, which enforces stricter multiline
indentation. MESSAGE was a double-quoted YAML scalar, so its \n\n became real
newlines that were interpolated into the YAML payload at column 0 and broke
the document:

    Invalid input! Failed to parse contents of the provided payload
    SyntaxError: Expected property name or '}' in JSON at position 1

Single-quote MESSAGE so \n stays a two-character escape, and send the payload
as JSON, where an interpolated message cannot break the structure and \n is
exactly the newline Slack mrkdwn renders.

Verified end to end on a throwaway branch: the notify job was forced to run
under dryRun and delivered to Slack with errors: true, so a rejected delivery
would have failed the step.

Author: carole-lavillonniere

.github/workflows/weekly-release.yml

@@ -99,17 +99,25 @@ jobs:
       - name: "Send Message"
         uses: slackapi/slack-github-action@dcb1066f776dd043e64d0e8ba94ca15cc7e1875d # v4.0.0
         env:
-          MESSAGE: "_*Weekly RIE release failed*_ :turtle-headache::broken_heart:\n\nNo new pre-release was published, so CVE remediation is stalled until this is fixed. Investigate the failed workflow run <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|here> :mag_right:"
+          # Single-quoted so \n stays a two-character escape. In a double-quoted YAML scalar it
+          # becomes a real newline, which lands unindented inside the payload below and breaks
+          # parsing under the stricter js-yaml v5 rules that slack-github-action v4 ships.
+          MESSAGE: '_*Weekly RIE release failed*_ :turtle-headache::broken_heart:\n\nNo new pre-release was published, so CVE remediation is stalled until this is fixed. Investigate the failed workflow run <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|here> :mag_right:'
         with:
           webhook: ${{ secrets.COSY_WEBHOOK_URL }}
           webhook-type: incoming-webhook
           # Default is false, which swallows Slack-side delivery errors and reports the step as
           # green. For the alert that tells us releases are broken, a silent failure is the one
           # outcome we cannot afford.
           errors: true
+          # JSON rather than YAML: an interpolated message cannot break the document structure,
+          # and \n inside a JSON string is exactly the newline Slack mrkdwn wants.
           payload: |
-            blocks:
-              - type: "section"
-                text:
-                  type: "mrkdwn"
-                  text: "${{ env.MESSAGE }}"
+            {
+              "blocks": [
+                {
+                  "type": "section",
+                  "text": { "type": "mrkdwn", "text": "${{ env.MESSAGE }}" }
+                }
+              ]
+            }