Consolidate event dispatch policy

[darthfork]

Summary

• add a GitHub event dispatcher module that owns supported event registration and unsupported-event outcomes
• route both synchronous webhook fallback and async worker processing through the same dispatcher policy
• update async tests and integration tests to inject event handlers through the dispatcher seam
• bump .go-version to Go 1.25.11 so security scans use the patched standard library

TDD notes

• RED: added dispatcher interface tests for supported routing and unknown-event rejection
• GREEN: introduced the dispatcher module and wired synchronous webhook dispatch through it
• RED: added async processor coverage proving async processing uses the shared dispatcher
• GREEN/REFACTOR: removed the async-only handler map and routed worker processing through the dispatcher

Cardinality guardrails

• no Prometheus collector definitions in src/metrics.go were changed
• metric recorder cardinality guard tests remain in place

Verification

• make test-all
• make lint
• make security