feat: add synclo inbox webhook mode

[lefarcen]

Summary

• add webhook.mode = "synclo-inbox" with explicit webhook.synclo config for base URL, stable consumer, secret env, limit, and poll interval
• poll synclo pending deliveries with the required HMAC signatures, forward successful deliveries into the existing local webhook queue, then ack only those delivery IDs
• expose synclo inbox runtime status and document setup, consumer stability, and polling fallback semantics

Design trade-off

New concept: a synclo inbox poller as a third webhook delivery mode.

Concrete failure prevented: teams sharing a central GitHub webhook inbox can wake Looper without each daemon running its own gh webhook forward session or managing duplicate repo hooks.

Cost: this adds a second remote queue dependency, HMAC signing surface, stable consumer naming requirements, ack retry behavior, and another runtime lifecycle to stop/reconcile. It can replay retained events if the consumer changes, and it still depends on synclo retention.

Simpler alternative considered: keep only GitHub polling or only local gh-forward/tunnel. That avoids a new poller, but it does not use the existing synclo fan-out queue and keeps low-latency wakeups tied to local GitHub forwarding or per-daemon hook management.

Authority for ack: the authority for acknowledging a synclo delivery is the local WebhookForwarder.Forward call returning successfully for that exact GitHub delivery_id; this is not agent structured output.

Notes

• This does not make GitHub polling disappear. Polling remains the correctness fallback and drift-recovery path.
• check_run support depends on the shared synclo GitHub hook subscribing to check_run; this PR consumes it through the existing Looper route once present.

Tests

• go test ./...
• go vet ./...
• go build ./...

[quangdang46]

Hermes QA Report | PR #506

Verdict: COMMENT - Code changes are clean. Pre-existing test flakes unrelated.

Checks Passed

• go vet: PASS
• go build: PASS
• synclo-specific tests: PASS (poll, forward, ack cycle with HMAC signature)
• config validation tests: PASS

Code Review

• Clean poller loop design with HMAC-signed HTTP, context-aware, mutex-guarded state
• Proper HMAC-SHA256 for pending GET and ack POST requests
• Thread safety on all shared status fields
• Sets degraded status on failures, clears on recovery
• Solid E2E integration test covering signatures, forwarding, acking, and status

Pre-existing Failures (unrelated to this PR)

• internal/agent: 3 timing/heartbeat flakes
• internal/cliapp: 5 version mismatch tests
• internal/e2e: 1 daemon startup timeout flake
• internal/runtime: 1 scheduler polling timing flake

Recommendation: Ready to merge after pre-existing test instability is addressed (out of scope).

Ran at 2026-06-21T10:15Z from Hermes QA cron.