gh: CheckSignature is a no-op — it validates nothing

[whywaita]

Problem

CheckSignature (pkg/gh/github.go:131-137) is called from the webhook path as if it validated the event's installation ID, but it only checks that ghinstallation.NewFromAppsTransport returns non-nil — which it always does:

func CheckSignature(installationID int64) error {
	if itr := ghinstallation.NewFromAppsTransport(&appTransport, installationID); itr == nil {
		return fmt.Errorf("failed to create GitHub installation")
	}
	return nil
}

No signature is checked (actual HMAC validation correctly happens in pkg/web/webhook.go via github.ValidatePayload), and the installation ID is not verified against anything. The function name suggests a security control that does not exist, which is dangerous for future readers/refactors.

Suggested fix

Either delete it, or make it real: verify installationID exists in listInstallations(ctx) (the cached list is already available via GetInstallationByID).