feat(cursor-origin): Route webhooks via Origin's headers

[wedamija]

Route webhooks using Origin's webhook-event-type and webhook-installation-id
headers instead of reading the unverified body. Installation events and pings go to
control, while other events go to the cells.

Unknown events return 202 and are counted without being queued. Event metrics are
limited to Origin's documented event types so arbitrary headers cannot create metric
series. Invalid or stale deliveries are rejected before looking up the integration or
writing to the queue.

Cell routing uses the hashed repository ID from the payload as the mailbox key.

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want reviews to match your repository better? Bugbot Learning can learn team-specific rules from PR activity. A team admin can enable Learning in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit c3b5a2e. Configure here.}

[cursor]

Uncached integration lookup on cell path

Low Severity

get_response calls get_integration_from_request directly, then get_cells_from_organizations resolves the same integration again through integration_for_request. That memoized helper exists so each parser does one query and one decrypt of encrypted integration metadata; other parsers call it instead of the uncached override.

 

^{Reviewed by Cursor Bugbot for commit c3b5a2e. Configure here.}