[P3] Prevent potential request body double-read in webhook handler

[itsmiso-ai]

Problem

The PR follow-up webhook reads request.arrayBuffer() after authorization. If authorizeRequest ever consumes the body, the HMAC verification silently succeeds on an empty buffer.

Evidence

• src/app/api/pr-followup/webhook/route.ts — authorizeRequest(request) called before request.arrayBuffer()

Acceptance

Move the body read before authorization, or document that authorizeRequest must not consume the body. Add a test that verifies body integrity after authorization.

---

Decomposed from #648 (Weekly tech debt audit: misospace/dispatch - 2026-07-22).