Adds TB003 Unsigned Known Provider Webhook enforcement.
V1 active automated blockers are now exactly:
- TB001 Client-Side Secret Exposure
- TB002 Destructive Public RLS / DB Rules
- TB003 Unsigned Known Provider Webhook
TB003 blocks confirmed critical unsigned webhook routes for supported known providers: Stripe, Clerk, Shopify, and GitHub.
Verified:
- Local tests, typecheck, and build passed.
- External red test blocked unsigned Stripe webhook with TB003.
- External green test passed signed Stripe webhook.
- Immutable v1.1.0 tag passed.
- Floating v1 tag passed.