Motivation

• Improve unit test coverage for the webhook fixture crate to catch subtle bugs in HMAC handling, payload canonicalization, and cache identity.
• Ensure provider-specific signature inputs and negative "near-miss" scenarios are validated across GitHub, Stripe, and Slack profiles.

Description

• Added new unit tests in crates/uselesskey-webhook/src/lib.rs covering an RFC-style long-key HMAC-SHA256 vector to exercise the key-hashing branch (hmac_sha256_hashes_keys_larger_than_block_size).
• Added tests that verify WebhookPayloadSpec::Raw payloads are used verbatim for signature inputs for GitHub, Stripe, and Slack (raw_payload_is_used_verbatim_for_signature_inputs).
• Added deterministic cache identity checks to ensure fixtures are stable for identical (profile, label, payload_spec) and differ when any element changes (fixture_cache_identity_includes_profile_label_and_payload_spec).
• Added cross-profile negative tests that exercise near-miss scenarios (StaleTimestamp, WrongSecret, TamperedPayload) and verify provider verification rejects them (near_miss_scenarios_are_marked_and_recomputed_for_each_profile).

Testing

• Ran cargo test -q -p uselesskey-webhook, which completed successfully (16 passed; 0 failed).
• Ran cargo clippy -q -p uselesskey-webhook --all-targets -- -D warnings, which completed with no lints reported.

Codex Task