fix(webhooks): validate outbox worker configuration

[bokelley]

Summary

• reject missing or synchronous tenant sender resolvers at startup while supporting wrapped async methods
• require a positive outbox delivery budget after the lease safety margin
• document the beta.9 schema and fixed-to-resolver migration, including the no-overlap rollout requirement
• lock in the RFC 9421 fixed-sender contract with regression coverage

Follow-up hardening from the expert review of #1081 and merged PR #1085.

Validation

• uv run pytest -q tests/test_task_webhook_outbox_pg.py tests/test_webhook_signing_capabilities.py tests/test_decisioning_dispatch.py (138 passed across final focused runs)
• make lint
• make typecheck-all
• commit hooks: Black, Ruff, mypy, Bandit, type-contract checks, and repository hygiene checks

[aao-secretariat]

Ladon verdict: Approve

Approve — clean follow-up hardening on the PG task-webhook outbox.

What I checked:

• No critical/high findings (row 1 does not fire).
• gated_paths: false — row 2 does not apply despite review_decision: REVIEW_REQUIRED.
• high_risk: true, but the only reason is src/adcp/decisioning/pg/task_webhook_outbox.py (modified) — a modification with zero medium-or-higher findings, so it is presumed safe (rows 3–5 require a deletion or a medium finding; none present).
• No prior decision; no no-auto-approve team match (row 7 clear).
• Zero findings total, so row 8 (≥3 medium) does not fire.

The change rejects non-async / missing sender resolvers at construction (fail-closed, with inspect.unwrap for @wraps'd async methods), raises the lease_seconds floor to keep the delivery timeout budget positive, and documents the beta.9 fixed-to-resolver migration with a no-overlap rollout requirement. Both new reject branches plus the RFC 9421 sender path are tested. No public-surface, wire-shape, or type-layering impact. Falls through to row 9 → approve.