feat(sink): signature panel — HMAC + timestamp freshness (S4)

[williamdewitt]

Part of #49 (WebhookSink epic). Slice S4. One agent run, samples/** only.

Blocked by #66.

Acceptance criteria

• For a captured hook, verify a Standard-Webhooks signature: HMAC-SHA256 over {id}.{timestamp}.{body} against a configured secret, plus timestamp-freshness check.
• Dashboard shows a per-hook verdict (valid / invalid / stale) and the reason.
• HMAC is hand-rolled for now — add a TODO + doc note to swap to the receiver WebhookVerifier when M3 lands (epic: security hardening + receiver verify #9 / the M3d issue).
• Tests cover valid, tampered-body, wrong-secret, and stale-timestamp cases.

Definition of done

• Builds net10.0, 0 warnings; tests green; changes confined to samples/**.

Design: docs/design/webhook-sink-design.md (seam #1: signature verification, S4).