Fix flaky t.TempDir cleanup race in webhook tests (closes #198)

HandleWebhook starts a deployment in a detached goroutine that keeps
writing under the app data dir (the test's t.TempDir). The webhook
tests slept 100ms and returned, racing Go's automatic TempDir cleanup
and intermittently failing with "RemoveAll: directory not empty".

Track those goroutines in a sync.WaitGroup on the webhook Service and
expose WaitForDeployments; the tests now wait on it instead of
sleeping. Deploy joins its own sub-goroutines before returning, so the
wait covers every temp-dir write. Production behavior is unchanged
apart from making completion observable.

Model: opus-4-8

TODO.md

@@ -20,6 +20,10 @@ main cannot regress.
 
 # Completed Steps
 
+- 2026-09-22: Fixed the flaky `t.TempDir` cleanup race in
+  `internal/service/webhook` by tracking the async deployment goroutine
+  in a `sync.WaitGroup` and exposing `WaitForDeployments`; tests now
+  synchronize on completion instead of sleeping (#198).
 - 2026-09-22: Linting now runs only in Docker. Added `Dockerfile.lint`
   (pinned golangci-lint v2.12.2, cache-busted via a `GATE_RUN` build arg
   so the linter always executes), reduced `script/lint` to building it,