ci: lift rotation check out of a double-negation (QF1001)

staticcheck flagged the De-Morgan form. Readability-wise the flat
sequence is also easier.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

Author: hallelx2

pkg/queue/qstash_verify.go

@@ -96,8 +96,11 @@ func (v *Verifier) Verify(signature string, body []byte, expectedURL string) err
 
 	// Try current key, then next key (rotation support). Constant-time
 	// compares guard against timing attacks.
-	if !hmacMatches(v.currentKey, signingInput, sig) &&
-		!(len(v.nextKey) > 0 && hmacMatches(v.nextKey, signingInput, sig)) {
+	ok := hmacMatches(v.currentKey, signingInput, sig)
+	if !ok && len(v.nextKey) > 0 {
+		ok = hmacMatches(v.nextKey, signingInput, sig)
+	}
+	if !ok {
 		return errors.New("qstash verifier: signature mismatch")
 	}