feat(github): verify webhooks and persist idempotent scan requests

[back1ash]

Summary

Implement the durable GitHub App intake boundary for pull-request, base-update, rerequest, installation, and repository events.

Scope

• Verify webhook signatures from the raw request body.
• Persist delivery identity and enqueue intent atomically before acknowledging.
• Derive immutable repository, installation, pull request, base, head, and test-merge identities.
• Handle duplicate delivery without duplicating logical runs.
• Return bounded visible errors and retain no unnecessary payload secrets.

Acceptance criteria

• Valid deliveries receive a durable acknowledgement within the agreed budget.
• Invalid signatures and unsupported events fail closed.
• Redelivery cannot create duplicate logical work.
• Repository and installation identity use immutable numeric IDs.
• Payload logging and metrics redact tokens and untrusted sensitive content.

Dependencies

• decision(product): record the Phase 0 go-no-go outcome #18
• build(release): package the CLI with SBOM and provenance #28

Priority gate and claiming

Keep status:blocked until every open priority:p1 issue is closed,
the Phase 0 hosted-product decision is proceed, and every explicit
dependency above is closed. Only then replace it with status:ready
and add help wanted.

To claim a ready issue, assign yourself, replace status:ready with
status:in-progress, and comment with a short implementation plan.

Non-goals

• Fetching repository content, running scans, or publishing Check Runs.
• Private-repository support.