[Validation]: Webhook intake should precheck-escalate Validate that secret-handling or migration requests escalate before worktree preparation and PR publication.

[zhyongrui]

Summary
Validate that the GitHub webhook intake path precheck-escalates an issue before any approval or queue entry when the issue explicitly references Validate that secret-handling or migration requests escalate before worktree preparation and PR publication..

Expected behavior

• plugin snapshot stage becomes escalated
• delivery reason becomes precheck-escalated
• no pending approval entry is created
• no queued run is created

Why this exists
This is a repository-local validation issue for the webhook suitability precheck. It should not implement auth, secret handling, or permission changes.