Accept large GitHub promotion pushes for deploy

## Gap Architecture decision A-16 (epic 12247) kept the GitHub trigger ingress body cap at 1 MiB (`apps/api/app/routes/public.py:249-251` reads `triggers.MAX_BODY_BYTES`; nginx edge 2 MiB at `apps/web/nginx.conf.template:689`) and deferred raising it to Finish. Effect: a promotion push over 1 MiB (roughly 500+ commits with file lists — e.g. a develop→master promotion on the Jaah repo) is refused 413 in GitHub's delivery log, and that deploy's range shows `partial: push too large`; PRs only in the lost push are never mapped and get no `deployed` edge. ## Fix Raise the cap for `github` triggers whose `source_config.record_only` is true only (the Production QA Deploys trigger), to a bound you justify (e.g. 25 MiB, GitHub's max payload), reading in a streamed, capped way so the unauthenticated read stays bounded; verify the HMAC signature before parsing; keep 1 MiB for every other source; raise the nginx edge limit only on the trigger ingress location. Security surface (unauthenticated read size): run the autonomous security review lane and close its findings in the PR. ## Acceptance - A signed 5 MiB `push` delivery to a record-only github trigger is accepted and the stored event is trimmed as today (`{ref,before,after,forced,commits:[{id}],head_commit}`) — test. - The same size to a non-record-only github trigger or a webhook trigger → 413 — test. - Over the new cap → 413 without reading past it — test. - An unsigned oversized body is refused without being buffered whole — test. Out of scope: other trigger kinds' limits; range/reconcile logic; any new storage. Done means: - Tests above green; security review lane findings closed in the PR body. - Required checks: ./dc check quick, changed-area tests, merge lane full gate.

Record-only GitHub triggers now accept signed pushes up to 25 MiB; everything else stays at 1 MiB, cap chosen before reading; nginx streams the trigger path. Security lane findings closed. Quick gate + changed-area tests green. PR #7655 queued in lane. Memory: none applied.