GET /api/v1/repos/{owner}/{name}/hooks/{id}/deliveries answers a webhook's last deliveries, as the hooks page shows them #7870

The hooks page and the terminal's Hooks screen show each webhook's recent deliveries: state, attempts, last status, why it failed. Over the API a hook is only listed, added and removed (src/http/api/hooks.ts). An agent wiring an integration cannot see why its endpoint gets nothing.

Done:

• [ ] GET /api/v1/repos/:owner/:name/hooks/:id/deliveries answers { items: [{ id, state, attempts, lastStatus, lastError, kind }] }, newest first, at most 20, from the existing recentDeliveries in src/core/webhooks.ts. It never includes the hook's secret, a payload body or a signature.
• [ ] Same gate as GET …/hooks: an admin token scope and a repository admin. Anyone else, and a hook id from another repository, gets the same 404 as a hook that does not exist.
• [ ] An OpenAPI route file src/contract/openapi/routes/getApiV1ReposOwnerNameHooksIdDeliveries.ts, shaped like getApiV1ReposOwnerNameHooks.ts, and the contract test passes.
• [ ] test/api-hook-deliveries.test.ts: a hook with one ok and one failed delivery lists both with their status and reason. A non-admin token, a read-only token and another repository's hook id each get 404. The secret appears nowhere in the body. Each check fails without the route.

Files: src/http/api/hooks.ts, src/contract/openapi/routes/getApiV1ReposOwnerNameHooksIdDeliveries.ts, test/api-hook-deliveries.test.ts. Risks: do not edit docs/MCP.md or README.md (hot). Builder: mason or torque.