Scheduled tasks — event/webhook triggers (GitHub, Slack)

Summary

Add event/webhook trigger sources (GitHub, Slack, etc.) beyond cron/one-shot for scheduled tasks.

Part of #189 (scheduled tasks). Split out of #236 (deferred/v2) — this is a full trigger ingestion subsystem, too large for the v2 finish PR (#256).

Scope

• A new TriggerSpec variant: Webhook (an incoming HTTP endpoint + a filter/transform that maps the webhook payload to a fire prompt).
• GitHub webhook integration (push, PR, issue events).
• Slack integration (slash commands, events API).
• The webhook trigger registers an HTTP endpoint on the mecated HTTP listener; the handler validates the webhook signature, applies the filter/transform, and calls the existing FireFunc seam.
• Security: webhook secrets in the operator-tier config (never project-tier); signature validation fail-closed; the transformed prompt is UNTRUSTED (fenced if carried-context is also set).

References

• Design: #189 (Prior art survey: Claude Code Routines GH webhooks, Cursor events, Devin events).
• The v2 finish: #256.

Start with the design and prior-art discussion in #189, then review the TriggerSpec variants, the mecated HTTP listener, and the existing FireFunc seam. Done means GitHub and Slack webhook events can be received, signatures validated fail-closed, filtered into fire prompts, and handled with the stated operator-tier secret and untrusted-prompt rules.