[gateway] Deduplicate webhooks using X-GitHub-Delivery id

[yinkscss]

Context

GitHub may redeliver webhooks. Idempotency today relies on (program_id, pr_number) in payouts, but duplicate deliveries before payout insert can cause unnecessary RPC attempts.

Problem

Replayed deliveries add load and noisy error logs. The roadmap risk register calls for raw event persistence and replay safety.

Proposed scope

• Add unique index on webhook_events.delivery_id when present
• Short-circuit processing when delivery id was already processed
• Store delivery id on all webhook ingestion paths (ignored, failed, processed)

Acceptance criteria

• Duplicate X-GitHub-Delivery returns 200 with status duplicate without re-attesting
• Migration adds unique constraint on non-null delivery ids
• Existing pr_number idempotency remains intact
• Document behavior in security checklist replay section

References

• crates/gateway/src/routes.rs
• crates/gateway/src/attestation.rs (persist_webhook_event)
• migrations/001_init.sql
• docs/ROADMAP.md risk register