A contract test belongs on a schedule, not on a push

A test that validates a third party’s responses detects their change rather than yours, so failing a pull request on it blocks the wrong person.

on:
  schedule: [{ cron: '0 6 * * *' }]
  workflow_dispatch:

jobs:
  contract:
    steps:
      - run: vendor/bin/phpunit --testsuite=contract
      - if: failure()
        run: ./bin/notify '#integrations' 'provider contract changed'

Notifying a channel rather than failing a build is the right severity, because the action is to re-record fixtures and possibly to update the client — neither of which blocks the change somebody was making at the time. It also needs credentials for a sandbox, which is a secret that exists only for this job and should be scoped accordingly.