fix: address code review safety findings

[tae2089]

Summary

• reject source-file symlinks and preserve unreadable files during incremental reconciliation
• reject multi-owner webhook admission while repo-name-only namespaces are in use
• validate Wiki namespace output paths and stop docs generation on malformed manifests
• support CCG_WEBHOOK_SECRET and update English/Korean operator guidance

Why

The full repository review found six safety and data-integrity issues. Source symlinks could escape the analysis root, unreadable files could be mistaken for deletions, repositories from different owners could collide in one namespace, Wiki output accepted traversal paths, malformed docs manifests were silently ignored, and webhook secrets had to be passed through process arguments.

Impact

Build and update ingestion now use stable no-follow source reads. Incremental updates preserve graph state when a source cannot be read. Ambiguous webhook configurations fail before runtime initialization. Invalid Wiki namespaces and malformed docs manifests fail before output mutation. Operators can inject webhook secrets through the environment while retaining explicit flag override behavior.

Verification

• CGO_ENABLED=1 go test -tags fts5 ./... -count=1
• CGO_ENABLED=1 go vet -tags fts5 ./...
• race tests for workflow, reposync, contentfiles, docs, and ccg-server
• source-built ccg build .
• source-built ccg docs --out docs
• source-built ccg lint (one pre-existing unrelated unannotated-symbol warning remains)