release-list ingest endpoint. POST /webhook (GitHub, HMAC-signed) or /reconcile (bearer). No data served here.