chore(cats): signing hook so the HMAC-authenticated /webhook-deliveries endpoints get real fuzz coverage

[ericfitz]

Summary

The worker endpoints GET/POST /webhook-deliveries/{delivery_id} and /webhook-deliveries/{delivery_id}/status authenticate by HMAC webhook signature, which CATS cannot produce — every one of their 72+ campaign findings is the documented 401 "Invalid webhook signature" (now suppressed by FP rule WEBHOOK_SIGNATURE_401 from run 20260820T034449Z). The correct rejection is verified constantly; the endpoints' actual logic is never fuzzed.

Acceptance Criteria

• A CATS-side mechanism signs requests to these paths with the seeded subscription's secret (candidates: a custom CATS header provider, a pre-request hook in the cats plugin, or scoped runs through a signing proxy) so positive-path fuzzing reaches the handlers.
• A validating scoped run shows non-401 coverage on both paths.
• Revisit rule WEBHOOK_SIGNATURE_401 afterward (it should then suppress only genuinely unsigned fuzz).

Notes

From the run-20260820T034449Z triage (cluster 1), maintainer-approved plan. 5 of the 77 cluster findings didn't match the rule's body predicate and remain visible for next-run triage. Refs #608.

[ericfitz]

Note for the next full CATS campaign's review: the triage from run-20260820T034449Z landed in #802 (main, 1.8.21). Two parts of it are not yet proven — they only exercise on a fresh campaign:

• the third, non-pinned seeded webhook subscription plus the per-path refData override that finally gives POST /admin/webhooks/subscriptions/{webhook_id}/test real coverage (previously the global webhook_id was the operator-pinned subscription, so the endpoint only ever produced its guard 403);
• the WebhookDelivery example payload now mirroring the handler's exact test-payload shape, which should clear the three chore(cats): track upstream Endava/cats#206 — CATS validates 2xx responses against example, not schema #657-class "Not matching response schema" warns.

Expected outcome next run: the 8 remaining true positives drop to the 5 webhook-signature variants tracked here.