feat(webhook): receive verified GitHub events and persist target state

[zoeyrose]

Summary

Implement the Cloudflare Worker and Durable Object side of the control plane.
It must receive only trusted completion events for the Classic mainline image
publication workflow and turn them into durable, target-scoped desired state.

Implementation / behavior

• Subscribe the GitHub App to workflow-run completion events with read-only
  Actions access.
• Verify X-Hub-Signature-256 against the raw request body and deduplicate
  X-GitHub-Delivery values.
• Allowlist atrinik/classic, the final staging-image workflow, main, and a
  successful conclusion.
• Bind the event to the exact head SHA and commit-addressed image tag or
  digest; never deploy a mutable latest reference.
• Store the desired release in the target Durable Object before returning a
  successful webhook response.
• Keep the webhook response bounded and perform agent notification
  asynchronously.
• Persist the latest desired state while agents are offline and deliver it on
  authenticated reconnect.
• Reject stale, duplicate, fork-originated, malformed, or policy-ineligible
  events.

Acceptance criteria

• Unit tests cover valid, invalid, replayed, duplicate, stale, fork, and failed
  workflow-run payloads.
• A webhook delivery cannot select an arbitrary target, image repository,
  command, path, or secret.
• Durable Object state survives hibernation and Worker restarts.
• A redelivered event produces one logical deployment intent.
• The control plane exposes only credential-free health and authenticated
  operator/agent routes.
• App permissions, webhook events, secret names, and selected repository
  identity are documented for atrinik/github-settings.

Dependencies

• Parent:
  feat(control): implement NAT-friendly agent control plane #2
• Classic publisher:
  feat(release): publish immutable main images for deployment control classic#516

Non-goals

• Do not run Docker or builds inside the Worker.
• Do not provision the GitHub App or Cloudflare production bindings in a
  pull request.