Webhooks carry custom_data, so callers who only ever saw payments arrive never
noticed that reading a transaction back threw it away. Anyone reconciling out of
band — a webhook that never landed, a status check after the browser closed —
got a payment with no way to tell what it was for.

The SDK types custom data loosely enough that a transaction created elsewhere
can hold a shape we did not write, so anything that is not a string-keyed array
reads as absent rather than reaching the caller as a surprise.

Split from f59438de74e97b1ae1a07f980e4c21a5a037fc80