Add an optional owners[] field to groups (super-admin only). When set,
only webhook events whose repository owner or organization login matches
enter that group's routes; empty owners means no restriction, keeping
existing routes backward compatible.
- types: Group.owners?, groups.ts groupAcceptsOwners()
- webhook.ts eventOwners() extracts repo owner + org login
- discord.ts dispatch skips routes whose group rejects the event owner
- admin-routes.ts validateGroups() validates owners list
Skip re-processing when the same X-GitHub-Delivery id is seen (KV, 300s TTL)
to stop double pushes when both an org and an App webhook target the worker.
Pass ExecutionContext through so dispatch runs via waitUntil instead of a
fire-and-forget that gets frozen. Cache the imported HMAC key per secret.
