GitHub App identity unification + atomic webhook-secret swap (retire reviewwed[bot])

[JSONbored]

Part of #983.

Context

reviewbot runs as a LIVE Cloudflare Worker under bot identity reviewwed[bot], installed on gittensory + awesome-claude + metagraphed ALONGSIDE the gittensory App. Convergence requires ONE GitHub App (gittensory's). The old per-agent secrets must be mapped in and the webhook secret swapped ATOMICALLY — if the swap is non-atomic, every webhook 401s. The single-writer invariant (only one App writes per repo) is operational, not code-enforced; this issue retires reviewwed[bot] as the writer identity (the earlier agent-rename migration minimized 11 old comments — same pattern).

Deliverables

• Converge onto the ONE gittensory GitHub App; confirm it is installed on all 3 repos.
• Map the OLD per-agent secrets into the gittensory App: appId, PKCS#8 appPrivateKey, webhookSecret, internalSecret, TAOSTATS_API_KEY, draft OAuth secrets.
• Swap the webhook secret ATOMICALLY (verify no 401 window; stage the new secret, flip, confirm signature verification before retiring the old).
• Confirm gittensory's Workers-AI quota absorbs 3 repos' dual-model + vision + RAG-embedding load (degrade-to-manual fail-safe, never a wrong action).
• Retire reviewwed[bot] as the writer identity (do NOT yet delete the Worker — that is feat(github-app): add command-specific @gittensory responses #18); ensure exactly one App writes per repo.

Acceptance criteria

• All 3 repos are served by the single gittensory App with all old secrets mapped in.
• The webhook-secret swap is atomic with zero observed 401s; signature verification passes on the new secret before the old is retired.
• reviewwed[bot] no longer writes; the single-writer invariant holds per repo.

Notes

• Milestone: M1
• Depends on: State + audit migration (decision-cache/approvedSha/reputation/tunables/review_audit) before cutover #1025
• Non-atomic webhook-secret swap = every webhook 401s. Stage + verify before retiring the old secret. Confirm AI quota/cost ceiling for 3 repos on the single AI binding with a degrade-to-manual fail-safe.