feat(frontdoor): git-push webhook — the fail-closed trigger that deploys - #38

…oys (#37)

deploy_flow.on_push is the build->deploy->preview flow, but nothing turned a real `git push` into a
deploy. This is that trigger: a governed webhook receiver the git host (Gitea/GitHub) POSTs to on
every push. It closes the last named gap in BUILD_DEPLOY.md ("the only remaining piece is the push
trigger") — `git push` now literally deploys.

It is FAIL-CLOSED at the door: an unsigned or mis-signed push is NEVER built and NEVER deployed.

tools/push_webhook.py — a pure, unit-tested core + a thin stdlib http.server wrapper:
  - verify_signature: constant-time HMAC-SHA256 over the RAW body; accepts GitHub
    `X-Hub-Signature-256: sha256=…` and Gitea `X-Gitea-Signature: …` (bare hex). Empty secret/body/
    header => False.
  - parse_push_event: normalises the git-host push payload (branch vs tag, delete, changed files).
  - handle_push: verify FIRST; a bad signature returns `rejected` with NO build started. Tags/deletes
    are ignored. The full source tree at the pushed SHA is resolved by an injected checkout callback
    (falls back to the payload's changed files, documented). Emits a SEALED, tamper-evident receipt
    bound to the exact body digest — the project secret is never sealed, echoed, or written.
  - serve(): POST /hooks/<tenant>/<app>, per-tenant secret from the sovereign store; 401 rejected /
    202 accepted / 422 build-failed. GET only /healthz.

Same fail-closed posture as the rest of the stack: the trigger itself is a zero-trust gate, not an
open hook — the sovereign answer to an anonymous deploy webhook.

Wired: capd/git-push-webhook.mesh.capd.json (caps.dev.git-push-webhook, composes_with git-push-deploy);
validate.py (required tool + CapD); Makefile `push-webhook`; portal evidence view surfaces
webhook-receipts; docs/BUILD_DEPLOY.md documents the trigger.

Tests: +14 = 196 tools tests green (signed deploys, unsigned/forged/body-tampered rejected & never
built, tag/delete ignored, resolve_files override, sealed+persisted receipt, secret never leaked).