busbar-auth-webhook-signature pinned and linked, default-on (Twilio / Standard Webhooks inbound verify)

[MattJackson]

Pins and links the fourth auth crate, busbar-auth-webhook-signature (BUSBAR-1.6.0.md l.818-823, OWNER Q99; l.845-852, ONE mechanism-named inbound auth plugin, scheme webhook-signature, variants Twilio and Standard Webhooks; l.4835, the TWILIO inbound auth). Twilio Media Streams, Standard Webhooks and the OpenAI Responses webhook receiver are verified through it, and none of them can be authenticated by the shipped binary without it.

What changes

• Workspace dependency pinned at GetBusbar/busbar-auth-webhook-signature. This draft pins ac7eabef; it moves to the merge sha of compiled_in::door::door: the entry busbar's auths row links busbar-auth-webhook-signature#15, which adds the compiled_in::door::door entry the linked-entry row names.
• crates/busbar: feature auth-webhook-signature, in default (ARCHITECT 2026-10-14, option (a)), with linked, linked-axes (auths), linked-entry and linked-name rows mirroring sigv4 and oauth.
• deny.toml allows the git source. qa/kind-isolation.toml gets the busbar -> busbar-auth-webhook-signature shipped row (count 1). plugins.yaml comment updated.

Customer-visible difference (one cell)
GET /api/v1/admin/info build.auth_modules goes from ["keys","admin-tokens"] to ["keys","admin-tokens","busbar-auth-webhook-signature"] (oracle cell admin.ops|GetInfo|ok). It is registered as an additive accepted difference of OWNER-LOCKED #64's class, with a premise pinning the exact list, and the CHANGELOG line is under 1.6.0 Added. DRAFT until the owner signs: the entry's signoff.who names the ARCHITECT ruling pending the owner, so changelog-register:entry-signed stays red until then. An agent cannot sign.

REDs

• crates/busbar/tests/auth_webhook_signature_linked.rs: busbar --validate with an auth.chain naming the module resolves it to the linked row. Unlinked, it prints "no plugin matching" / "was not loaded".
• crates/busbar/src/root/tests/linked_auth.rs the_info_auth_modules_are_the_inbound_rows_only: the default build lists exactly 1.5.5's two plus this module.

Waits for: GetBusbar/busbar-auth-webhook-signature#15 (pin sha), #910 (holds linked_auth.rs; this hunk is disjoint, at its the_info_auth_modules test), and the owner's signature.