[i098]

Closes #1090

Summary

A small Rust webhook receiver and a Firstmate patch let the watcher read GitHub events first and poll the API only as a slow, quota-guarded fallback.

What changed and why

• Add apps/fm-gh-webhook, a Rust receiver on 127.0.0.1:8788. It checks the HMAC-SHA256 signature with GH_WEBHOOK_SECRET from the host env file, never logs the secret, and exits 78 without it.
• It writes one marker per merged pull request, and one record per completed check under ci/, keyed by event type, id and name. The watcher reads only merged/ for now; CI records have no reader yet (owner decision).
• Patch 0007-watch-webhook-events.patch: the merged-PR poll reads the marker first, then calls the API once per FM_GH_FALLBACK_POLL seconds (default 600).
• Quota guard: rate_limit is read at most once a minute; below 20 percent remaining the interval is four times longer, below 5 percent no call is made.
• docs/github-webhook.md and a changelog fragment. The playbook registers no webhook and writes no secret.
• Ponytail-review: one round, no named keeps.

Test evidence

cargo test in apps/fm-gh-webhook (6 passed); patch suite 7 of 7 and pytest -k webhook_events pass; a signed payload gave 204 and a bad signature 401.

Checklist

• One concern in this PR.
• The title uses the commit format, for example fix(provisions): check the digest before install.
• Tests pass (uv run pytest). Not applicable: only the new and neighbouring tests were run here; CI runs the full suite.
• Lint clean (uv run ruff check).
• Ansible syntax clean (--syntax-check). Not applicable: ansible-playbook is not on this host; the YAML parses.
• Idempotent: launch → launch = changed=0 on the second run. Not applicable: the playbook must not run against this host.
• A changelog fragment, changelog.d/<issue>.<type>.md (not a CHANGELOG.md edit), or the no changelog label.

[i098]

Reviewed at head da7ecad. The no-mistakes run passed review, tests, documents, lint and push. The CI event path was fixed to keep one record per check name. Checks are green at this head. Main CI is red from an earlier, unrelated python test failure; this PR does not touch that path. No open findings.