fix(webhooks): bound signature verification work (#2475)

## Summary
- Limit webhook signature candidates to 32 before importing a
verification key or performing HMAC work.
- Preserve existing typed failures, timestamp validation, rotated
signatures, prefixed and bare formats, and both public webhook
entrypoints.
- Cover the exact acceptance boundary, malformed signatures, real HMACs,
and existing short-signature mock compatibility.

## Validation
- Full handwritten suite: 149 files / 6,291 tests.
- Full generated suite: 82 suites / 556 tests against an isolated local
Steady server.
- Focused public webhook tests: 46 passing.
- Full lint, strict TypeScript, build, published TypeScript 4.9 and
current compatibility, publint, packed CommonJS/ESM and 1,264 source
maps.
- Built CommonJS and ESM clients both reject over-budget signatures
before verification and accept the final valid signature at the
32-candidate boundary.