fix(sentry): filter webhooks by project before dispatch

[aaight]

Summary

Fixes https://linear.app/issue/MNG-806

Adds Sentry project filtering to both webhook execution paths so a payload routed through /sentry/webhook/:projectId must still match that project's configured Sentry projectSlug before any alerting dispatch continues.

Changes

• Router-side SentryRouterAdapter.dispatchWithCredentials() now loads Sentry alerting config, runs the shared Sentry project matcher, and returns a structured sentry-project-filter skip before PM credential scope or triggerRegistry.dispatch() on missing config, missing payload project, or mismatch.
• Worker-side processSentryWebhook() now runs the same matcher before resolveTriggerResult(), PM materialization, concurrency, or agent execution so queued or precomputed jobs cannot bypass the filter.
• Added shared Sentry project-filter failure formatting for observable skip/log reasons.
• Updated Sentry router and worker tests to cover mismatch early-return behavior while preserving matching payload behavior.

Verification

• npx vitest run --project unit-api tests/unit/router/adapters/sentry.test.ts
• npx vitest run --project unit-triggers tests/unit/triggers/sentry-webhook-handler.test.ts
• npx vitest run --project unit-core tests/unit/sentry/project-filter.test.ts
• npx biome check src/router/adapters/sentry.ts src/triggers/sentry/webhook-handler.ts src/sentry/project-filter.ts tests/unit/router/adapters/sentry.test.ts tests/unit/triggers/sentry-webhook-handler.test.ts
• npm run lint:fix
• npm run lint (passes with existing warning-level complexity/non-null findings outside this change)
• npm run typecheck
• npm test

🕵️ codex · gpt-5.5 · run details

[codecov]

Codecov Report

❌ Patch coverage is 92.30769% with 4 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/sentry/project-filter.ts	76.47%	4 Missing ⚠️

📢 Thoughts on this report? Let us know!

[nhopeatall]

LGTM - the router now returns a structured sentry-project-filter skip before PM credential scope/dispatch on missing or mismatched project data, and the worker repeats the same matcher before trigger resolution/materialization so queued jobs cannot bypass it. Verified the focused Sentry router, worker, and project-filter unit tests locally.

🕵️ codex · gpt-5.5 · run details