feat: replace GitHub notification polling with webhook-driven events

Swap the polling-based notification flow for a local webhook server that
receives GitHub events directly, verifies signatures (HMAC-SHA256), and
maps them to the existing workflow dispatch pipeline. Removes the
pr-review-mentions workflow in favor of a broader repo-watcher workflow.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: bluedbird

config/system.yaml

@@ -11,8 +11,12 @@ provider:
   model: ""
   extraArgs: []
 
-# GitHub workflow polling (scaffolded, not started yet)
+# GitHub webhooks (requires GitHub App + tunnel)
 github:
-  enabled: true
-  pollIntervalSec: 60
+  enabled: false
+  token: ${GITHUB_TOKEN}
   workflowsDir: ./workflows/github
+  webhook:
+    port: 3100
+    path: /webhooks/github
+    secret: ${GITHUB_WEBHOOK_SECRET}