fix: ignore duplicate workflow_job completed events for a job already scaled down

[ankit373]

Fixes #4315.

Bug

GitHub resends workflow_job completed events for jobs that already finished in an earlier run of the same workflow run, when a user reruns only the failed jobs instead of all jobs. The webhook server applies every completed event as an unconditional -1 capacity reservation. A burst of resent completions lands in the same batch as the new queued event for the rerun job, nets the reservation to zero, and the rerun job's runner never gets scheduled. It stays queued indefinitely.

The issue includes webhook server logs showing exactly this: one queued event and five resent completed events processed in the same second, netting {"added": 1, "completed": 5, "after": 0}.

Fix

A workflow job ID only completes once. Handle now tracks job IDs it already scaled down for and skips a repeat completed event for the same ID within a bounded window (scaledDownForDedupWindow, one hour). This also covers plain webhook redeliveries, not just the rerun case.

The dedup state is in-memory and per-pod, same as the worker/batch-scaler queue it feeds. Multiple webhook-server replicas without sticky routing already have that limitation for the existing queue, so this isn't a new constraint.

Test plan

Added TestWebhookWorkflowJobCompletedDedup: sends the same completed event through one handler instance twice. First delivery scales down by 1, second is ignored.

Verified the test catches the bug by reverting the fix first: both deliveries scaled down by 1.

• go build ./controllers/...
• go vet ./controllers/actions.summerwind.net/...
• go test -race -count=1 ./controllers/actions.summerwind.net/... (all non-envtest tests pass)
• gofmt -l clean on both touched files

[ankit373]

Friendly ping, this has been open since August. I merged current master in (52 commits behind, no conflicts) and re-ran it on the merged tree: build, go vet, golangci-lint and the controllers/actions.summerwind.net tests all pass locally.

CI has not actually run on this PR (the August runs never started any jobs), so could a maintainer approve a workflow run? @nikola-jokic, would you have a moment to look, or can you point me to whoever owns the webhook autoscaler? Happy to change anything.