feat(forge): notify router + snapshot apply (RIG-2732) - #676

T2 of RIG-2732 Piece-2 (webhook-only agent-notification): the event front door for both providers, producing the pipeline's single normalized currency (`forge.ForgeEvent`).

- `internal/forge/notify_event.go`: the `ForgeEvent` normalized-currency struct.
- `internal/forge/githubapp_webhook.go`: `VerifyGitHubSignature` (constant-time HMAC-SHA256 over the raw body) + `ParseGitHubEvent` mapping the Approach event table to normalized events; bodies stripped via `StripOwner` at normalize (the one strip point); `check_suite.completed` carries `HeadSHA` with a nil `ChecksSummary` (router fetches the roll-up).
- `internal/linearagent/data_event.go`: `ParseLinearDataEvent` for Issue/Comment data-change payloads (create->OPENED, update->STATE-iff-updatedFrom-state else UPDATE, comment->COMMENT; remove counted-and-dropped; project id -> `ForgeEvent.Project`).
- `server/github_webhook.go`: `NewGitHubWebhookHandler` — the DL-254 shape (verify -> ack 200 -> enqueue), delivery-id LRU dedup, oversized-body rejection. Unmounted (T7 wires it).

Red-first unit tests cover signature vectors, every event-table row, PR-vs-issue comment discrimination, Linear state-vs-update, project id mapping, `check_suite` HeadSHA+nil-Checks, `StripOwner`, and the handler's signature/oversize/dedup paths.

Refs RIG-2732

Co-authored-by: Matt Wilkinson <matt@rigel.build>

…G-2732)

Review fixes for the webhook ingress slice (PR #675), all reconciling code to the frozen design record (design.md:534-537):

- Body cap 25 MiB -> 1 MiB (design.md:536): keeps the per-request buffered-body allocation small (events are single-digit KB); the old 25 MiB opened a 25x-wider memory-amplification window than the record authorizes.
- Enforce ack-fast: document that `ForgeEventSink.Enqueue` MUST NOT block (it hands off to the async drain loop), and flush the 200 onto the wire before Enqueue so a blocking sink can never delay the client-visible ack.
- Bad/missing signature returns 400, not 401 (design.md:535).
- Add handler tests: verified-but-malformed -> 200 + no enqueue; missing signature header -> 400; secret-unavailable -> 503. Add event-table rows for issues `reopened` -> STATE and pull_request `unlabeled` -> UPDATE.

Refs RIG-2732

Co-authored-by: Matt Wilkinson <matt@rigel.build>

T4: the `ForgeEvent` hot path — `NotifyRouter.Route` + pure `ApplyEvent`/`SnapshotRevision`.

- `notify_router.go`: package-local structural seams (`NotifyStore`, `NotifyDispatcher`, `ChecksRoller`) + `NotifyRouter`. `Route` runs the frozen algorithm (design.md:841-872): load prior snapshot -> resolve CHECKS roll-up before apply -> `ApplyEvent` -> upsert cursor BEFORE notify -> resolve subs (OPENED=container/project-matched, per-artifact=exact coordinate) -> dispatch a `ForgeNotification` carrying revision. Never advances `delivered_revision` (W3, ack-driven).
- `notify_detect.go`: `ArtifactSnapshot` canonical form + pure `ApplyEvent` + `SnapshotRevision` (sha256 of canonical JSON, sorted checks, map-keyed comments) — the cross-producer meeting-point contract shared with T5.
- Red-first unit tests with fakes for both seams, incl. the meeting-point invariant.

Reconciled seams (single-admissible readings, not open forks): `NotifyStore` gained `LoadArtifactCursor` (the frozen 3-method block omits the point read the algorithm's step 1 needs); `ChecksRoller` returns a placeholder `ChecksResult` in this commit, collapsed into the real `forge.ConditionalResult[forge.Checks]` by T5 stacked above; UPDATE/REVIEW are snapshot-neutral and labels are excluded from the digest (the `ForgeEvent` currency carries no title/body/labels, so the canonicalization invariant holds trivially).

Refs RIG-2732

Co-authored-by: Matt Wilkinson <matt@rigel.build>

…-2732)

Review fixes for the notify router slice (PR #676):

- Extend `Route`'s coordinate guard to reject `ev.Number == 0`, not just zero provider/kind. The frozen Global Constraint makes a zero number a caller bug for every event kind (ForgeEvent.Number is always set; on OPENED it is the new artifact's number), so a zero-number event must be `ErrInvalidArgument`, never a bogus number-0 cursor write. OPENED is unaffected (it carries the new artifact's number).
- Add router error-path tests: a `LoadArtifactCursor` error aborts before upsert/dispatch; a `ChecksRoller` error on a CHECKS event aborts before apply; an `UpsertArtifactCursor` error surfaces and dispatches nothing (proving upsert-before-notify ordering under failure). These fakes exposed the error fields but no test set them.

Refs RIG-2732

Co-authored-by: Matt Wilkinson <matt@rigel.build>