fix: security committer identity check false positive on GitHub UI rebase (web-flow)

[myakove]

Problem

The security committer identity check (run_security_committer_identity in webhook_server/libs/handlers/runner_handler.py) produces a false positive when a PR is rebased via the GitHub web UI.

When rebasing through the GitHub UI, GitHub re-creates commits with the committer set to web-flow (GitHub's internal bot account), while preserving the original author. The check compares last_commit.committer.login against pull_request.user.login, so it flags web-flow != krcmarik as a security mismatch.

Root Cause

webhook_server/libs/github_api.py:657:

self.last_committer = getattr(self.last_commit.committer, "login", "unknown")

webhook_server/libs/handlers/runner_handler.py:407:

elif last_committer != parent_committer:

The check uses commit.committer.login but web-flow is a legitimate GitHub system account that signs all web UI operations (rebase, merge, squash, file edits, "Update branch" button).

Same false positive triggers for

• GitHub UI "Update branch" button (merge or rebase)
• GitHub UI commit squash
• GitHub UI file edits
• Any GitHub web-based commit operation

Proposed Fix

Whitelist web-flow as a known GitHub system account. When last_committer is web-flow, the check should pass (or use commit.author.login as fallback).

Done

• Whitelist web-flow in the committer identity check
• Add debug logging when web-flow is detected
• Add tests for web-flow scenario
• Update existing tests if needed

[myakove]

Design Decisions (for Qodo review responses)

1. last_committer_id defaults to 0 — This is intentional. If a committer has no resolvable GitHub user ID, it is NOT the verified web-flow account. Treating ID 0 as "suspicious" is correct behavior — a missing ID on a web-flow-named committer IS suspicious. This is not a fail-fast violation; 0 is a legitimate sentinel for "no ID available."

2. Web-flow check does NOT compare commit author to PR author — This is the core fix. The previous author comparison broke when maintainers rebase bot PRs via GitHub UI (e.g., pre-commit-ci[bot] PRs rebased by a human). The verified web-flow user ID (19864447) is sufficient — GitHub already authenticated whoever triggered the web operation.

3. last_author fetch is kept — Used for debug logging (observability). The API call is cheap since the data is already cached on the fetched Commit object. Removing it would reduce debugging capability for no meaningful performance gain.