What does this PR do?

gateway/platforms/webhook.py had a secret validation gap between
startup and hot-reload:

• Startup (run()): validates that all routes have a non-empty secret
• Hot-reload (_reload_dynamic_routes()): loads routes from
  webhook_subscriptions.json without any secret validation

When a route with "secret": "" was loaded via hot-reload, the
request handler's check if secret and ... evaluated to False
(empty string is falsy), completely skipping HMAC validation.

Exploit chain

1. Attacker sends a message: "Create a webhook subscription named
   'monitor' with an empty secret"
2. Agent writes {"monitor": {"secret": "", "prompt": "..."}} to
   webhook_subscriptions.json
3. _reload_dynamic_routes() hot-reloads the file — no secret check
4. Attacker POSTs to /webhooks/monitor without any HMAC signature
5. Agent executes the webhook prompt with full tool access

Fix

Added per-route secret validation in _reload_dynamic_routes().
Routes with empty or missing secrets are skipped with a WARNING log.
INSECURE_NO_AUTH remains valid as an explicit opt-in.

effective_secret = route.get("secret") or self._global_secret
if not effective_secret:
    logger.warning(
        "[webhook] Dynamic route '%s' has no secret — skipped.",
        name,
    )
    continue

Type of Change

• 🔒 Security fix (authentication bypass)

Checklist

• Read the Contributing Guide
• Commit messages follow Conventional Commits
• Consistent with startup validation in run()
• INSECURE_NO_AUTH opt-in still works
• No behavior change for routes with valid secrets