feat: add paperclip-pr-notify with code-level event filtering

[marvin-tensorleap]

Why this change exists

Part of the TEN-302 GitHub↔TEN mapping architecture. New workflow applies deterministic code-level filtering before forwarding events to the Paperclip GitHub Event Router routine (TEN-319). Without filtering, every repository event would spawn a Paperclip agent.

How this PR fixes it

Only actionable events are forwarded to ${{ secrets.PAPERCLIP_WEBHOOK_URL }}:

• check_suite: only completed + failure|timed_out|action_required + linked open PR present
• pull_request: opened, closed, synchronize, reopened
• pull_request_review: submitted with state approved or changes_requested
• issues: opened, assigned, closed
• issue_comment: created only

Payload is signed with HMAC-SHA256 (X-Hub-Signature-256 header).

Technical summary

• New file: .github/workflows/paperclip-pr-notify.yml
• Requires repo secrets: PAPERCLIP_WEBHOOK_URL, PAPERCLIP_WEBHOOK_SECRET

Verification

Once repo secrets are configured, open a draft PR (should forward) and add a label (should not forward).

[marvin-tensorleap]

Closing — this approach was superseded before merging. Paperclip plugin-based webhook dispatch handles event filtering locally. See TEN-319 and TEN-302.