Listen for `push` events otherwise github won't participate in a Hook.test-based handshake; fix verification HMAC bug