Webhooks carry custom_data, so callers who only ever saw payments arrive never
noticed that reading a transaction back threw it away. Anyone reconciling out of
band — a webhook that never landed, a status check after the browser closed —
got a payment with no way to tell what it was for.

The SDK types custom data loosely enough that a transaction created elsewhere
can hold a shape we did not write, so anything that is not a string-keyed array
reads as absent rather than reaching the caller as a surprise.

Split from cd50d284fe8490f5407c3127a32e9d3a7bc1b233