Webhook credentials do not prove subscription coverage

A configured webhook signing secret and healthy handler prove only that the receiver can authenticate deliveries. They do not prove the provider subscribed the endpoint to every event the feature needs.

For event-selective providers, require either control-plane subscription readback or one controlled end-to-end delivery for each critical event type. Route tests, secret-presence checks, and unrelated callbacks are insufficient. This matters less when the provider unconditionally sends every event to one endpoint.