Create a task directly from a generic inbound webhook payload.

The endpoint is intentionally small and separate from the trigger-manager flow: callers POST a task-shaped payload and Bernstein creates one task. BERNSTEIN_WEBHOOK_SECRET must be configured (fail-closed; ) and each request must carry a fresh X-Bernstein-Timestamp header plus a matching X-Bernstein-Webhook-Signature-256 HMAC over f"{timestamp}.".encode() + body. The plaintext X-Bernstein-Webhook-Secret fallback has been removed; callers relying on it must upgrade to the HMAC + timestamp flow.

Automation bridge (#2512): an admitted trigger returns a signed, chain-anchored trigger receipt in receipt so the calling platform holds a proof of what it asked for rather than a bare task reference. A trigger that fails authentication, or that replays a trigger id already admitted, is refused with its own signed refusal receipt (HTTP 401 and 409 respectively) -- the negative path leaves a record, never a silent drop.