fix(git): webhook receiver — fork-sync events + missing deployment version (#47)

Two fixes in the push receiver:

- Accept repo-sync events (`sync`, `repository_dispatch`, `workflow_run`)
  that carry no ref — fork-sync bots and Actions dispatch these instead
  of pushes. Branch falls back to the webhook filter then the service's
  own git_branch; repo-only match when no branch is known.
- The deployment INSERT omitted the NOT NULL `version` column, so every
  webhook-triggered deploy failed the insert silently and enqueued
  nothing. Push-triggered deploys have been dead since the receiver
  shipped. Now set `v<unix>` like the manual deploy path.

Verified live: repository_dispatch → branch=main, 1 deployment enqueued;
push → 1; star → ignored.

Generated with [Devin](https://devin.ai)

Co-authored-by: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ROADMAP2.md

@@ -332,8 +332,13 @@ and wired refs, one click or one CLI call.
   events (HMAC-verified) and enqueues matching services. Settings→env
   fallback wired into install-URL + installation-token paths.
   `containr admin github-app` CLI + MCP + OpenAPI.
-- [ ] **fork-sync trigger** — accept repo-sync events on webhook
-  receiver.
+- [x] **fork-sync trigger** — webhook receiver accepts `sync`,
+  `repository_dispatch`, and `workflow_run` events (no `ref`) alongside
+  pushes: branch falls back to the webhook filter, then the service's
+  own `git_branch`; repo-only matching when no branch is known.
+  Also fixed a latent bug where the webhook's deployment insert omitted
+  the NOT NULL `version` column — push-triggered deploys silently
+  failed for every service.
 - [ ] **Dynamic filter framework** — port dflow's `filter.utils`
   pattern (typed filter configs → URL state → client filtering) for
   audit logs, deployments, notifications tables.