Handle signed webhook challenges before event-only checks

A webhook challenge must be handled before checks that apply only to event callbacks. A provider may omit workspace or channel fields from its URL-verification payload, even when later events carry them. Verify the challenge request's signature first, return its challenge, and keep strict workspace and channel checks for actual events. Otherwise setup fails despite a correctly signed request. This exception is limited to the challenge payload; it must not relax authentication or the event path.

Applies when: installing a signed event subscription with a separate challenge request. Keywords: webhook challenge signature workspace event callback verification missing fields