feat: enable guarded webhook canary ingestion

[giscebot]

Summary

• add canary webhook mode backed by the existing policy file
• enqueue only supported actionable deliveries for repositories explicitly listed in enabledRepos
• translate signed structured payloads into the common transport-neutral queue
• preserve first-writer-wins idempotency across webhook and IMAP
• document the durable ordering and recovery behavior

Safety boundary

Shadow remains the default. Canary fails closed without a policy file, an empty enabledRepos enqueues nothing, edited/unsupported deliveries remain observational, and IMAP continues unchanged.

The queue transaction commits before the monitoring receipt. A crash in that narrow gap cannot lose work: GitHub retries the delivery, the webhook receipt key deduplicates the queue operation, and the retry repairs monitoring.

Dependency

Stacked on #232 so operators can measure the canary before enabling it.

Validation

• pytest -q — 392 passed on the complete stack
• dashboard npm test -- --run — 60 passed
• dashboard npm run build — passed

Requested by: @ecarreras

Refs #191

TASK-85718