[HIGH] RwLock overhead on hot path — every webhook request acquires read lock

[ironclaw-ci]

[HIGH:70] Issue Found by Staging CI Review

Severity: HIGH
Confidence: 70/100
PR comment: #865 (comment)

Description

RwLock overhead on hot path — every webhook request acquires read lock

---

Auto-created by staging-ci Claude Code review

[henrypark133]

Triage verdict: Legit

src/channels/http.rs:224 — every webhook request acquires webhook_secret.read().await to validate. This was introduced for SIGHUP hot-reload support (commit f8c5672). Consider atomic swap or caching to avoid RwLock contention on hot path.

[henrypark133]

Triage: FALSE POSITIVE — RwLock read is properly scoped (dropped before async ops) and read locks don't contend with each other. The lock is held for microseconds during HMAC validation only.