Test the nodes against a real Hookdeck project

[garethx]

Adds live test suites that exercise the built nodes against a real Hookdeck
project, so the README's claims are backed by measurements rather than by the
unit suite's stubs.

The unit suite proves what the node sends. These prove what Hookdeck does
with it — which is where every finding below came from.

test/integration.test.mjs moves in here too, as
test/live/provisioning.test.mjs. The repo had two live-test conventions
covering different ground, each with its own API client, node contexts and
cleanup; that split is now legible rather than accidental. CI runs the whole
test/live/ directory in place of test:integration.

Suites

File	Covers	Needs
api.test.mjs	every provisioning option, all three generic verification schemes, and all 29 action-node operations	API key
verification.test.mjs	Stripe and GitHub signature schemes, signed and forged, plus the node's own 401/400 paths	API key
delivery.test.mjs	real events through hookdeck listen, output shape, retry metadata, dedup, pause/resume	API key + hookdeck CLI
provisioning.test.mjs	source adoption vs rewrite, CLI-destination fallback, Source Get or Create	API key
stripe.test.mjs	a genuine Stripe webhook, endpoint created and torn down via the Stripe CLI	+ stripe login

All skip with a stated reason when prerequisites are missing, so forks and the
default npm test are unaffected. The delivery suite now checks for the Hookdeck
CLI on PATH rather than spawning it blind — CI installs neither CLI, so it would
otherwise fail with ENOENT and read like a broken node.

Moving the integration suite also brought it under the delete guard. Its
resources were previously removed by an exact-name match, which would have
deleted a same-named production source; they now carry the run id like
everything else.

What running them turned up

• A platform-typed source reveals nothing about whether it verifies. A
  STRIPE source with a secret and one without return byte-identical config.
  Generic WEBHOOK sources do expose config.auth_type. So the README's
  "looks identical to an unconfigured one" is right for platform sources and
  wrong for generic ones.
• Verification failure is not uniformly a 200. STRIPE answers 200 with
  verified: false and rejection_cause: VERIFICATION_FAILED; GITHUB refuses
  outright. Never infer verification from the status code, in either direction.
• attemptTrigger is INITIAL/AUTOMATIC/MANUAL/BULK_RETRY/UNPAUSE —
  never RETRY. Anything branching on 'RETRY' never fires.
• Real Stripe signs with t,v1,v0 — three schemes, where the documented
  example shows two.
• Delivery groups are a plan entitlement; without it the entire connection
  upsert is rejected. That case skips with the reason rather than passing quietly.
• Source adoption is load-bearing for secrets. Provisioning adopts an
  existing source untouched, so applying a secret to one that already exists
  needs updateExistingSource. Without it the secret is accepted, silently
  discarded, and deliveries arrive unverified — caught by the Stripe suite
  against a real endpoint.
• Rate limiting lives at destination.config.rate_limit; deleted resources
  answer 410, not 404; there is no /events/count.

Safety

These run against a project that also holds production sources, so destroy()
refuses to delete anything not carrying the run's own id, across all three naming
forms — including the one the node derives from the workflow id, which was
missed at first and left resources behind. Cleanup failures are reported loudly
rather than swallowed.

hookdeck listen is spawned detached and killed by process group: the hookdeck
on PATH is an npm wrapper around the real binary, and signalling only the
wrapper leaves that binary holding its connection open and the parent process
alive. Fixing that took one suite from a 600s timeout to 64s.

Verification

Rebased on current main. npm run test:live — 45 pass, 1 skip (delivery
groups, not enabled on the test org), exit 0, no leaked resources, no orphaned
processes. npm test 106 pass. Skip paths checked directly: no API key skips
every suite, and a missing CLI skips delivery and Stripe.

Unrelated and left alone: both nodes now trip
icon-prefer-themed-variants — the icon is a single file:hookdeck.svg where it
was previously the { light, dark } form, and only hookdeck.svg remains on
disk. That is a verification-programme rule, so worth a separate fix.