v0.1.25.49 — spec-conformant webhook scope-filter matching + replay filtering

Spec-conformance release: webhook scope_filter matching now implements the admin OpenAPI spec's wildcard semantics, and replay honors the subscription's scope filter.

Changed

• BEHAVIOR CHANGE — webhook scope_filter matching is spec-conformant. WebhookRepository.matchesScope previously did literal prefix matching (trailing-/* filters matched nothing, any startsWith scope matched, null-scope events matched every filter). Now per the spec: exact match without a wildcard; trailing * = prefix match on children only (non-empty child segment; the bare base scope and the degenerate base/ do not match); bare * = any event that has a non-blank scope; null/blank event scopes are unscoped and excluded from every scope-filtered subscription; null/blank filters still match everything. See CHANGELOG [0.1.25.49] for the full migration guide (descendants-only rewrites, base+descendants needing two subscriptions, accidental sibling-prefix matches, unscoped events).
• With cycles-server v0.1.25.47's matching refinements, both planes now match identically — the same filter delivers the same scopes whether an event is emitted by the runtime or the admin plane, and both matchers pin the same test table.

Fixed

• Webhook replay honors scope_filter. Replay previously queued every event in the requested range (after event_types filtering) directly to the subscription, bypassing scope matching — it could deliver events the subscription would never have received live. Replay now applies the same spec-conformant matcher as live dispatch.

Compatibility

• No HTTP request/response schema, Redis data model, or Lua change. Which subscriptions receive a given event (live or replayed) can change as described above — operators using bare-prefix filters should apply the CHANGELOG migration guide.
• Release prep pins: full-stack compose bundles cycles-server 0.1.25.47 and cycles-server-events 0.1.25.22.

Full details: CHANGELOG.md [0.1.25.49], AUDIT.md entries, PR #206 (11+6 matcher tests + 5 replay tests ported to both planes).