fix(webhook): return 202 with task_id on sync timeout, add polling endpoint

[kagura-agent]

Problem

When a sync webhook request takes longer than syncTimeoutMs (default 25s), the channel returns 504 and the agent's response is lost forever — even though the agent completes work moments later (issue #26).

Solution

1. Graceful timeout: Instead of 504, sync timeout now returns 202 Accepted with a task_id
2. Response persistence: When the agent eventually completes, the response is stored in memory (auto-expires after 5 minutes)
3. Polling endpoint: New handlePollRequest() method for GET /webhook/poll?task_id=xxx:
   • 200 with response when complete
   • 202 while still processing
   • 404 for unknown task IDs
   • 400 for missing task_id parameter

Also fixes signature verification — HMAC was previously computed over the full body including the signature field, making verification impossible in practice. Now correctly excludes the signature field before computing HMAC.

Changes

• src/channels/webhook.ts: Add async fallback + polling + fix signature verification
• src/channels/__tests__/webhook.test.ts: 4 new tests (timeout→202, poll complete, poll pending, poll unknown, poll missing param)

Testing

bun test src/channels/__tests__/webhook.test.ts
# 17 pass, 0 fail

bun run lint
# Clean

Closes #26