fix(webhooks)!: honor durable authentication and operation IDs

[bokelley]

Summary

• preserve explicit Bearer/HMAC webhook authentication through durable task registration and delivery
• encrypt and authenticate stored webhook selectors and credentials, with pre-issuance validation and SSRF-safe transport policy
• require buyer-supplied ReportingWebhook.operation_id across canonical schemas, generated models, stubs, and migration guidance
• add tracked upstream schema patches and compatibility/security regression coverage

Validation

• 7,388 tests passed locally (41 skipped, 9 deselected, 1 expected failure)
• repository pre-commit suite passed
• Ruff and mypy passed across all source and strict adopter fixtures
• code, protocol, and security expert reviews report no remaining findings

Closes #1091
Closes #1092

BREAKING CHANGE: ReportingWebhook.operation_id is now required so scheduled delivery webhooks can echo a buyer-supplied correlation identifier.

[aao-secretariat]

Ladon verdict: Approve

Approve — clean webhooks PR, no blocking or medium findings.

Checked:

• Breaking change (ReportingWebhook.operation_id → required) is correctly signaled: fix(webhooks)! + BREAKING CHANGE footer + MIGRATION_v7_to_v8.md note. Semver signal on public surface satisfied.
• Generated-code edits pair with tracked schemas/patches and SCHEMA_DELTAS — regeneration output, not hand-edits.
• Security hardening verified: legacy Bearer/HMAC creds AES-256-GCM encrypted at rest, redacted from repr, scrubbed from persisted last_error; HMAC fail-closed behind legacy_hmac_fallback + advertised capability with boot-time alignment.
• Operational readiness: legacy sender IP-pinned, lease-bounded timeout, closed per-attempt in finally; pre-feature RFC bodies round-trip byte-identically. Heavy test coverage.

Gate check: gated_paths is false. high_risk is true, but all reasons are (modified) schema/decisioning files or (added) patch files — no deletions, and no medium-or-higher findings on any modified file, so rows 3–5 do not fire. No author team gate. No prior decision. review_decision is REVIEW_REQUIRED but gated_paths is false, so row 2 does not apply. Zero findings → falls through to row 9: approve.