Match webhook generation to the consumer contract

A provider inbox showing a reply does not prove that an application can capture it. Verify that an active webhook subscription targets the intended environment, event, and resource, and that the subscription's API generation matches the consumer's payload and signature contract. Legacy and dated webhook APIs may be separate subscription generations; a consumer expecting a versioned envelope and modern signature headers must not be wired to a legacy subscription.

Query the subscription list for the same API generation used to create the webhook, because an empty legacy list does not establish that newer subscriptions are absent. A controlled staging callback can demonstrate one configuration path; it does not establish production readiness or delivery guarantees.