spindle: ensure that event source is identical to the repo's knot

thanks @winter.bsky.social for the report!

Signed-off-by: oppiliappan <[e-mail]>

spindle/server.go

···
 			return fmt.Errorf("no repo data found")
 		}
 
+		if src.Key() != tpl.TriggerMetadata.Repo.Knot {
+			return fmt.Errorf("repo knot does not match event source: %s != %s", src.Key(), tpl.TriggerMetadata.Repo.Knot)
+		}
+
 		// filter by repos
 		_, err = s.db.GetRepo(
 			tpl.TriggerMetadata.Repo.Knot,