feat(p3.1-t2): Tier-2 三服務感知強化 — Sentry 簽章 + DiagnosisAggregator + Solver actions test

Wave 8 P3.1-T2 三項感知強化（多 engineer 補完）：

Sentry Webhook 簽章驗證:
- sentry_webhook.py: 接入 SentryWebhookService.verify_sentry_signature()
- 拒絕無效 sentry-hook-signature → 401 → 防偽造攻擊

DiagnosisAggregator Pod 深診斷整合:
- pre_decision_investigator.py: 新增 _collect_diagnosis_aggregator()
- ENABLE_DIAGNOSIS_AGGREGATOR feature flag 守衛（default=False）
- evidence_snapshot.py: extra_diagnosis 欄位 + build_summary 顯示
- timeout=3.0s + try/except 隔離（fail-soft）
- Conservative 策略：待重疊分析確認 vs PreDecisionInvestigator 不重複

config.py:
- 新增 ENABLE_DIAGNOSIS_AGGREGATOR Field（default=False，K8s ConfigMap 動態啟用）

Solver B1 補測（commit 7c726ebc 對應）:
- test_solver_recommended_actions.py — 20 tests + 3 skipped
- 驗證結構化 recommended_actions（北極星 §1.1 修復多樣性 ≥ 40%）
- LLM 失敗 graceful degraded（candidates=[], degraded=True）

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Co-Authored-By: Multiple Engineers (Wave 8 P3.1-T2) <noreply@anthropic.com>

apps/api/src/api/v1/sentry_webhook.py

@@ -37,6 +37,11 @@ from src.services.anomaly_counter import get_anomaly_counter
 from src.services.approval_db import get_approval_service
 from src.services.openclaw_http_service import get_openclaw_http_service
 from src.services.sentry_service import get_sentry_service
+# 2026-04-27 P3.1-T2 by Claude — Tier-2 三服務感知強化：補 SentryWebhookService 簽章驗證
+from src.services.sentry_webhook_service import (
+    SentrySignatureError,
+    verify_sentry_signature,
+)
 from src.services.telegram_gateway import get_telegram_gateway
 from src.utils.timezone import now_taipei_iso
 
@@ -101,6 +106,15 @@ async def handle_sentry_error(
     4. 回寫 Sentry Comment
     """
     try:
+        # 2026-04-27 P3.1-T2 by Claude — Tier-2 三服務感知強化：接入 SentryWebhookService 簽章驗證
+        body = await request.body()
+        sig_header = request.headers.get("sentry-hook-signature", "")
+        try:
+            verify_sentry_signature(body, sig_header)
+        except SentrySignatureError as sig_err:
+            logger.warning("sentry_signature_rejected", error=str(sig_err))
+            raise HTTPException(status_code=401, detail=str(sig_err)) from sig_err
+
         payload = await request.json()
         logger.info(f"Received Sentry webhook: action={payload.get('action')}")