GitHub App webhook receiver

Receives GitHub App events. Verifies the X-Hub-Signature-256 HMAC signature, checks delivery deduplication, and acknowledges quickly. The delivery is recorded only after handling succeeds: a handling failure answers 500 and writes no record, so GitHub’s redelivery is processed instead of being swallowed as a duplicate. Scan jobs are queued without GitHub API calls and run asynchronously; install-time jobs resolve the default-branch HEAD in the worker. Subscribe to push, pull_request, installation, installation_repositories, and marketplace_purchase events.