v0.1.25.40 — webhook lifecycle emit post-review polish

v0.1.25.40 — webhook lifecycle emit post-review polish

Post-review correctness pass on v0.1.25.39 webhook lifecycle Events. No new spec surface, no wire-format changes — strictly better output for listEvents consumers.

Fixed

• B1 — Actor parity on single-op lifecycle emits. createWebhookSubscription, updateWebhookSubscription, and deleteWebhookSubscription now populate Actor.keyId from authenticated_key_id, matching the bulk-action path. Audit consumers see consistent API-key attribution across all webhook lifecycle Events regardless of code path.
• B2/B3 — changed_fields is now a real diff. updateWebhookSubscription previously listed any field present in the PATCH body even when the value matched the subscription's current value. Each request-provided field is now compared against the prior snapshot; only genuine mutations land in changed_fields. A full-identity PATCH (every field resent with existing value, no status flip) is a true no-op and emits nothing — aligns with spec v0.1.25.33 §6281. signing_secret keeps presence-based detection (stored value is encrypted; not safely comparable to plaintext request value).
• B4 — Correlation-id uniqueness. The "no-req" literal fallback in webhook_update:<sub_id>:<request_id> and webhook_bulk_action:<action>:<request_id> is replaced with req_<uuid> fallback. Guarantees uniqueness across concurrent requests if RequestIdFilter ever fails to populate the attribute.

Compatibility

Internal-only fixes. No EventType / schema / endpoint / wire-format changes. Pairs with cycles-server-events v0.1.25.11 dispatcher-side webhook.disabled emit (unchanged).