What's new
- Enforced
public.webhook_events.workspace_idasNOT NULLafter a live preflight confirmed there are no unresolved webhook event rows.
Security and operations
- This closes the only nullable tenant key identified in the DB hardening sweep.
- The migration fails closed if any environment still contains unresolved webhook events.
- Stored webhook events must now always be tenant-resolved; unresolved raw webhooks should be rejected or staged outside the tenant-scoped table.