Build a zero-minute GitHub webhook dispatcher

[hyperpolymath]

Outcome

Receive GitHub repository events on owned infrastructure and start Bag checks without allocating a GitHub-hosted Actions runner.

Scope

• Implement an HTTPS webhook receiver for pull_request, push, and manual redelivery events.
• Verify GitHub webhook signatures before parsing the payload.
• Resolve and fetch the exact immutable head SHA; never execute an untrusted mutable branch name.
• Add delivery-ID idempotency, replay protection, bounded payload sizes, strict event allow-lists, and durable acknowledgement.
• Translate accepted events into the Bag command gateway rather than invoking shell commands directly.
• Post an immediate non-green/pending commit status while work is queued.
• Document private-repository, fork-PR, and unavailable-node behaviour.

Acceptance criteria

• A PR event can trigger an owned-node sweep with zero GitHub Actions minutes.
• Invalid signatures, duplicate delivery IDs, unsupported events, oversized payloads, and stale deliveries are rejected and tested.
• Event payload fields cannot become unsanitised command arguments or working directories.
• An end-to-end fixture covers webhook → command → Baton → signed status.

Dependencies

Depends on the hardened manifest/command contract and durable queue issues.