Github Webhook

Receive a GitHub App webhook, verify signature, and create tasks.

Handles the following event types:

• issues (opened / labeled)
• pull_request_review_comment / issue_comment
• push
• workflow_run (completed + failure) - creates a ci-fix task, capped at MAX_CI_RETRIES active attempts per branch.

Reads GITHUB_WEBHOOK_SECRET from environment for HMAC verification. Fail-closed: when the secret is not configured the endpoint is disabled and returns 503; unsigned GitHub webhooks are never accepted. Replay protection: if the caller includes an X-Bernstein-Timestamp header the request is additionally checked for freshness - drift greater than five minutes returns 401. Real GitHub deliveries omit this header and continue to work; the check is there so bernstein-internal relays cannot be replayed after capture. Returns 200 on success, 401 on bad/missing signature or stale timestamp, 400 on parse error, 503 when the endpoint is not configured.