Signature Verification

Use the security + signature guidance here:

• developers/webhooks/security-signatures

Canonical algorithm and fixtures:

• docs/contracts/v1/rc96/webhook_signature_verification.md
• docs/contracts/v1/rc96/fixtures/