feat: promote webhooks to primary with IMAP fallback

[giscebot]

Summary

• add explicit primary webhook mode after the canary gate
• require a second operator acknowledgement (GITHUB_AGENT_BRIDGE_WEBHOOK_PRIMARY_ACK=true) to prevent accidental promotion
• keep the same policy trust/action/routing decisions
• preserve IMAP as an active idempotent safety net and document configuration-only rollback
• include workflow conclusions in normalized input so failed runs retain their actionable classification

Safety and rollback

Primary mode fails closed without both a policy path and the explicit acknowledgement. Rolling back requires only returning webhook mode to shadow; the IMAP reader remains supported and must not be marked seen merely because webhooks are primary.

No arbitrary IMAP delay is introduced: delaying the reader would also delay genuine webhook gaps and complicate durable UID handling. Correctness remains independent of arrival order through the canonical event constraint.

Dependency

Stacked on #233. Enable only after #232 reports no unexplained IMAP-only actionable events for the agreed observation window.

Validation

• pytest -q — 392 passed
• dashboard npm test -- --run — 60 passed
• dashboard npm run build — passed

Requested by: @ecarreras

Refs #191

TASK-85718