docs(openspec): plan github-alerts change

[TOMOKI977]

Summary

Planning artifacts for change 2, github-alerts. No code.

GitHub issue and PR alerts go to the Telegram forum topic linked to each repo:

• Webhook: POST /github/webhook verifies the HMAC-SHA256 signature over the raw body before parsing. For now it uses a single global secret for one org.
• Linking: /linkrepo and /unlinkrepo are admin-only and run inside a topic. /repos is read-only and open to any team member.
• Org claim: an org must be claimed by the team before its repos can be linked. This stops another Telegram group from linking private repos and reading their alerts.
• Events: pull_request (opened, closed or merged, review requested) and issues (opened, closed). Alerts carry only allowlisted fields, and payloads are never stored or logged.
• Status codes: after a valid signature, the route returns 2xx. The exception is an infrastructure failure, which returns 500 so the delivery shows as failed in GitHub and can be redelivered.
• Deferred: digest/cron, per-team secrets, GitHub App, CI and release events, dedupe, and retention.

Size exception: about 580 lines, all documentation.

Files

• openspec/changes/github-alerts/explore.md, proposal.md, design.md, tasks.md
• openspec/changes/github-alerts/specs/{github-webhook,repo-topic-links,github-alerts}/spec.md

Delivery plan

Five PRs to main in order: domain and migration, D1 repos, route skeleton, delivery wiring, commands. Operator steps (claim the org, set the secret, configure the org webhook) are tracked in tasks.md Phase 6.