Reject placeholder webhook secrets in production

[BojayL]

Summary

• Adds WAVEFLOW_ENV=production to the Render gateway service.
• Rejects the default placeholder GITHUB_WEBHOOK_SECRET and short webhook secrets when running in production mode.
• Keeps development mode compatible with the example .env secret.
• Documents production webhook secret requirements in the environment reference and security checklist.

Fixes #32.

Validation

• cargo test -p waveflow-shared
• rustfmt --check crates/shared/src/config.rs
• git diff --check
• ruby -e 'require "yaml"; YAML.load_file("render.yaml"); puts "render.yaml ok"'
• Checked PR-facing files for restricted terms.