test(screenshot): cover the screenshot pipeline

[isadeks]

Closes #97.

Stacked on PR #273 (feat/96-linear-prefix-routing), which is itself stacked on PR #241 (screenshot pipeline). Review/merge after both. Once #273 merges I'll retarget this PR to main so the diff collapses to ~5 new test files.

Summary

Adds 53 jest tests across the four screenshot files that landed with #241 + #273 and previously had no coverage. Hermetic — no real AWS, no network. All AWS SDK clients and the WSS browser stream are mocked.

File	Tests	What it covers
github-webhook-verify.test.ts	14	SHA-256 sign/verify, secret cache TTL + forceRefresh, ResourceNotFound → null, transparent re-fetch on signature mismatch / null fresh
github-webhook.test.ts	15	Missing body/sig, ping ack, non-deploy events ignored, malformed JSON, state + environment filters, SCREENSHOT_TARGET_ENVIRONMENT override, missing fields, dedup hit, happy path, rollback-on-invoke-failure, non-condition DDB error
linear-issue-lookup.test.ts	18	Regex extract/multi/bounds/case-sensitivity, prefix-routing happy path, case-insensitive prefix match, fallback for legacy rows + post-prefix-miss, null-token skip, fuzzy-match guard, GraphQL errors / non-2xx / network failure
github-webhook-processor.test.ts	15	Empty/malformed body, missing fields, token resolve failure, PR-retry exhaustion, OPEN-only filter, happy path (with CloudFront-host URL assertion), screenshot/S3/comment failure modes (non-fatal where appropriate), Linear branch fires / falls back to body / skips on no-id / no-resolve / non-fatal post
agentcore-browser.test.ts	6	StartBrowserSession failures, full CDP exchange returning PNG bytes (Target.getTargets → attach → enable → navigate → loadEventFired → captureScreenshot), Stop invoked in finally even on CDP error, Stop's own failure logged not thrown, 403 unexpected-response surfaced, navigate errorText raised

Existing 286/286 handler tests still pass — 16 suites / 385 tests across the screenshot + linear + fanout + orchestrate + create-task + webhook surface area.

Test plan

• yarn jest --runInBand on the five new files: 53/53 pass
• Adjacent existing suites (linear, fanout, github webhook authorizer, orchestrate, create-task): 332/332 pass
• No source files touched