[gateway] Reject default placeholder GITHUB_WEBHOOK_SECRET in production

[yinkscss]

Context

.env.example uses change-me-to-github-webhook-secret. Nothing prevents deploying with default secrets.

Problem

Production deployments with guessable webhook secrets allow forged merge events.

Proposed scope

• Add WAVEFLOW_ENV=production or detect Render env to enforce secret strength
• Fail startup when secret matches known placeholders or is shorter than minimum length
• Document required secret entropy in security checklist

Acceptance criteria

• Placeholder secret fails startup in production mode
• Development mode still allows example secret
• Error message explains remediation
• security-checklist.md updated

References

• .env.example
• crates/shared/src/config.rs
• crates/gateway/src/main.rs
• docs/security-checklist.md

[BojayL]

/claim
Opened PR #48 with production webhook secret validation and docs.