feat: implement webhookd core

[0xProgress]

What this PR does

Implements the webhookd core: a single-binary Go program that listens for webhook HTTP requests, verifies their signatures via a pluggable provider interface, and streams one JSONL line per verified event to stdout. Includes the provider interface and registry, the HTTP server and request handler, the normalized Event output struct with JSONL and pretty writers, the mock reference provider, config resolution (flag → env → default), the cobra CLI, and the build/release tooling (Makefile, Dockerfile, goreleaser config, golangci config). No real provider (github, stripe, slack, shopify) is included — those are separate PRs against this frozen core.

Related issue

Closes #

Type

• New provider (scoped: the mock provider ships with the core; no real provider is added)
• Bug fix
• Documentation
• Refactor
• Chore / CI

How I tested it

Build and test:

$ go build ./...
(no output — clean)

$ go test -race -count=1 ./...
?   	github.com/0xProgress/webhookd	[no test files]
?   	github.com/0xProgress/webhookd/cmd	[no test files]
?   	github.com/0xProgress/webhookd/config	[no test files]
?   	github.com/0xProgress/webhookd/output	[no test files]
ok  	github.com/0xProgress/webhookd/providers	1.031s
ok  	github.com/0xProgress/webhookd/providers/mock	1.039s
ok  	github.com/0xProgress/webhookd/server	1.629s

Manual smoke test (the five-minute demo from README.md):

$ make build
go build -ldflags="-s -w -X main.version=48c28c0" -o bin/webhookd .

$ ./bin/webhookd mock &
webhookd 48c28c0 — listening on 127.0.0.1:8080, endpoint POST /mock

$ curl -s -XPOST localhost:8080/mock \
    -H 'X-Mock-Signature: valid' \
    -H 'Content-Type: application/json' \
    -d '{"type":"test.event","id":"evt_1"}'
{"provider":"mock","verified":true,"event":"test.event","id":"evt_1","delivery_id":"","received_at":"2026-09-16T20:31:42Z","payload":{"type":"test.event","id":"evt_1"}}
{"ok":true}

$ kill %1

stdout: exactly one JSONL line, in the shape specified by docs/webhookd-core.md §"Normalized Output Shape".
stderr: exactly one line (the startup banner), matching docs/webhookd-core.md §"Diagnostic formats".

What is not verified in CI yet:

• golangci-lint run ./... — the linter is not installed in this environment. The lint and check Makefile targets will fail on a machine without it.
• make check — it chains fmt vet lint test and will fail on the lint step for the same reason.
• docker build — Docker is not installed in this environment.
• goreleaser release --snapshot — goreleaser is not installed; goreleaser check was run and passed after a migration off deprecated keys.

---

Provider PRs only

Skip this section — this is not a real-provider PR. The mock provider does not need a docs/providers/mock.md because it is a reference implementation, not a production integration. Leaving this section unchecked.

---

General checklist

• make check passes locally with no errors
  → cannot be checked. golangci-lint and goimports are not
  installed in this environment. make test, make build, and
  make vet all pass. make check fails only on the lint step.
• PR title follows Conventional Commits (feat:, fix:, docs:, test:, refactor:, chore:, ci:)
• Nothing is written to stdout except through the JSONL event writer
• No secrets, tokens, or real webhook payloads are committed