chore(cats): apply the run-20260820T034449Z triage — five FP rules, /test-endpoint coverage, WebhookDelivery example fix

[ericfitz]

Maintainer-approved remediation of the validating campaign's 154 true
positives (zero server bugs / zero 500s / zero undocumented codes):

• Five false-positive rules (90-94): webhook-signature 401s (72),
  operator-pinned /test 403s (39), duplicate-group 409s from replayed base
  bodies (20), one-shot create_threat_model 409s (13), and huge-offset
  conformant-pagination 200s (2). All dry-run validated, zero 5xx matches;
  live reclassify suppressed 146, leaving 8 (5 webhook-signature variants
  for next-run triage + the 3 example-validation warns fixed below).
• POST /admin/webhooks/subscriptions/{webhook_id}/test gets real coverage:
  a third, non-pinned seeded subscription with a per-path refData override
  for just the /test path (the global webhook_id is the operator-pinned
  subscription, whose guard 403 was all the endpoint ever produced).
• WebhookDelivery's spec example payload now mirrors the handler's exact
  test-payload shape, closing the chore(cats): track upstream Endava/cats#206 — CATS validates 2xx responses against example, not schema #657-class "Not matching response
  schema" warns (CATS validates 2xx bodies against the example, not the
  schema; body verified schema-conforming independently).

Signing-hook coverage follow-up for /webhook-deliveries/*: #790.
Refs #608, #657.