🔒 This PR has been locked (consolidating). To unlock it, run st unlock.

Pure, transport-free building blocks for the webhook receiver, kept out of the
HTTP handler so they unit-test without a server:

• Verify(secret, body, sigHeader) checks the X-Hub-Signature-256 HMAC-SHA256
  with a constant-time compare, and fails closed on an empty secret/header so a
  misconfigured receiver never accepts unsigned payloads.
• ParsePush(body) extracts owner/name from a push payload, preferring
  owner.login + repository.name and falling back to splitting full_name.

No routing yet; the receiver wires these in the next change.

Stack

💡 Notice: This PR is part of a stack merge into branch stack-merge-stack-1782266218.

• PR refactor(web): remove sample alice/bob stacks from repo provider #1313
  • PR feat(server): drive deploy posture from STACKIT_ENV, not $PORT #1314
    • PR refactor(api): extract Syncer.SyncRepo for per-repo sync triggers #1315
      • PR feat(api): add GitHub webhook signature + push parsing helper #1316 👈
        • PR feat(api): add GitHub webhook receiver for evented refresh #1317
          • PR feat(api): coalesce webhook-driven syncs per repo #1318
            • PR feat(api): add manual sync endpoint for on-demand refresh #1319
              • PR feat(server): default sync interval to 5m and document evented refresh #1320
                • PR feat(server): index repos by owner/repo for GitHub-style routes #1322
                  • PR feat(server): serve repos at /repos/{owner}/{repo} path routes #1323
                  • PR feat(web): GitHub-style path URLs for repos, branches, stacks, PRs #1324

_{Auto-generated by Stackit}

Merged via consolidation into #1326 by jonnii