feat(api): add signed webhook verification and receiver

[bdsqqq]

changes

• SDK-backed signed webhook verification and explicit loopback-default receiver
• bounded bytes, strict UTF-8/envelope checks, unknown JSON fields, awaited stdout before acknowledgement
• one-second shutdown bound; interrupted output may truncate; no durable queue or deduplication

verification

exact-head 0d9f7e1 CI 35931662455 passes all jobs, including existing sandbox scenarios (NOT actual Linear webhook delivery). full offline checks and final 13 focused webhook tests pass; compiled preview passes with ad-hoc signing.
review reproduced real-pipe shutdown hang. production deadline fixed it in an independent undrained-pipe probe. deterministic subprocess regression holds output/stop promises and exercises the deadline; it is synthetic, not real-pipe evidence.

limits

no remote webhook registration, delivery, proxy verification or tunnel. OAuth/full parity remain incomplete. stacked on #32; draft only.