Webhook signature failures should be checked before secret rotation

A webhook debugging note about raw body verification, timestamp tolerance, secret version labels, and deployment timing.

Webhook signature failures are tempting to fix by rotating the secret, but that can add a second variable. I would first check raw body handling, timestamp tolerance, route middleware, secret version, and whether the runtime picked up the latest env value. If those are unclear, rotation can hide the original failure.