v0.7.1

Added

• verifySignatureOrThrow(input) — throwing variant of
  verifySignature exported from the root entry. Resolves silently
  on a valid signature; throws WebhookSignatureError on bad HMAC,
  missing header, malformed hex, or wrong byte length. Use this when
  wiring your own HTTP layer (not the SDK's Express / web / Hono
  adapters) and you want a typed error rather than a boolean.

Changed

• CI: bumped GitHub Actions to Node 24-compatible versions —
  actions/checkout@v5, actions/setup-node@v6,
  pnpm/action-setup@v6, actions/upload-artifact@v7,
  softprops/action-gh-release@v3. Removes the deprecation banner
  on every CI run; ready for Meta's 2026-06-02 Node 20 default
  removal.

Tests

• Added test/contract/public-surface.test.ts — a drift detector
  asserting every documented value/class/factory across the root
  entry and all five subpaths (/express, /web, /hono,
  /storage/redis, /storage/postgres) is reachable at runtime.
  If a sub-module export is added without being plumbed through, or
  a documented export is accidentally renamed/removed, this test
  fails before consumers do.
• Added negative-path coverage for WebhookSignatureError (5 new
  tests via verifySignatureOrThrow) and MockModeError (4 new
  contract tests pinning the public shape).
• Re-shimmed test/integration/express/middleware.test.ts to use a
  Promise-resolved-by-handler pattern instead of 5 ms setTimeout
  waits and wall-clock ack-timing windows — mirrors the
  determinism fix already applied to the web adapter test in 0.2.0.

524 tests pass (was 447).