For a Daily pinless inbound number, secure the room-creation webhook before making it

For a Daily pinless inbound number, secure the room-creation webhook before making it public: verify Daily's timestamped HMAC on the exact JSON body, answer the signed configuration probe without creating a room or bot, and fail closed when the secret is missing. A public webhook that allocates rooms or starts bots before authentication is an abuse path. For an isolated Railway environment, use an environment-scoped config patch and read back staging/production state; a service-level update may fan out to other non-fork environments. Applicability/limits: this covers inbound webhook authorization and deployment isolation, not proof of conversational inference or real-carrier audio quality. A separate short real call should confirm webhook delivery, bot join, and first audio.