feat: AdCP 3.0 webhook support (signing + idempotency)

[bokelley]

Summary

Implements publisher + subscriber helpers for the two AdCP 3.0 webhook baselines:

• spec(webhooks): require idempotency_key on all webhook payloads (#2416) adcp#2417 — idempotency_key required on every webhook payload. Receivers dedupe on this single canonical field scoped per authenticated sender.
• spec(webhooks): unify webhook signing on RFC 9421 profile adcp#2423 — RFC 9421 adcp/webhook-signing/v1 profile. Distinct tag + adcp_use from request-signing, content-digest REQUIRED.

Adds a new adcp/webhook package plus a new skills/build-webhook-publisher skill that the 6 agent-builder skills cross-reference. All existing signing/idempotency tests continue to pass — zero-value Profile preserves back-compat.

What's new

Core (adcp/signing, adcp/webhook)

• signing.Profile — {Tag, AdcpUse, ErrorPrefix} bundle. Exported vars ProfileRequestSigning (default) and ProfileWebhookSigning.
• signing.GenerateKeyForProfile — generates JWKs scoped for either profile via adcp_use.
• Error.WireCode(profile) — emits webhook_signature_* vs request_signature_* in WWW-Authenticate based on profile; Go-level ErrorCode constants stay stable.
• webhook.Marshal / Deliver / Publisher — sender primitives + production retry layer. Publisher retries 5xx/408/429 with exponential backoff + jitter, honors Retry-After, bounded by MaxAttempts (5) + MaxElapsed (1h). Terminates on 2xx / 4xx-non-retryable.
• webhook.HTTPHandler — receiver middleware composing RFC 9421 verification (ProfileWebhookSigning + DigestRequired) with idempotency-based dedup scoped per authenticated sender.
• webhook.DecodeConfig — typed accessor that pulls the subscriber URL out of push_notification_config (currently any on generated request types).
• 5 typed webhook payload types (MCPWebhookPayload, CollectionListChangedWebhook, PropertyListChangedWebhook, ArtifactWebhookPayload, RevocationNotification) with IdempotencyKey string as a required field. IdempotencyKeyPtr() methods auto-generated from WEBHOOK_SCHEMAS — future additions get methods for free.

Safety gates

• HTTPHandler panics when Verification is nil unless AllowUnverified=true AND a custom Sender is supplied. Blocks the "unsigned receiver + attacker-controlled scope" misconfiguration the security reviewer flagged.
• webhook.NewSigner force-overrides Profile = ProfileWebhookSigning so a webhook signer cannot accidentally emit a request-signing signature.
• JSON syntax errors in the body → 400 (not 500) so senders stop retrying malformed payloads.
• Deliver / Publisher shallow-clone the caller's *http.Client and install CheckRedirect = http.ErrUseLastResponse when unset — signed requests MUST NOT follow redirects.

Skills

• New skills/build-webhook-publisher/SKILL.md — canonical guide for signed webhook emission in Go agents.
• Cross-references added to build-seller-agent, build-generative-seller-agent, build-retail-media-agent, build-collection-agent, build-signals-agent, and build-creative-agent at each skill's async/notification section.

Validation

• 25 webhook tests including end-to-end HTTP round-trips over httptest.NewServer, cross-profile rejection, content-digest enforcement, dedup scope disjoint from request-side, retry classification, Retry-After parsing, MaxElapsed + context cancellation, and the profile-specific wire error prefix.
• 4 expert reviews (code, security, protocol conformance, DX). All HIGH findings addressed:
  • Security: the Verification=nil panic gate.
  • Code: Deliver now actually installs CheckRedirect; returns DeliverResult carrying the key.
  • Protocol: conformance clean on all 9 spec checks.
  • DX: rewrote Marshal mutation semantics, added ErrMissingURL documentation, removed import gaps from the Quickstart, clarified NewSigner's Profile override.
• Generation cycle: a coding agent given only these skills produced a working seller with webhook notifications that compiled on first pass and hit zero of the five flagged footguns.

Test plan

• go test ./... — all 4 packages pass (adcp, idempotency, signing, webhook)
• go vet ./... — clean
• gofmt -l — clean on all new/modified files
• TestSkillSkeletonsCompile — all 7 skills (including new webhook one) compile against the current SDK

Breaking changes

None for existing callers. Zero-value Profile resolves to ProfileRequestSigning everywhere it's read. Existing signing.NewSigner, signing.Middleware, and signing.VerifyRequestSignature callers continue to work without any code changes.

🤖 Generated with Claude Code