GitHub webhook receiver

Receives GitHub App webhook deliveries after signature verification. Delivery idempotency is DB-owned: completed duplicates return safe accepted responses, in-flight duplicates return a bounded retryable conflict, and handler failures leave the delivery retryable. Push events also persist per-project commit intent so API maintenance can retry deploy enqueue without relying on GitHub redelivery.