[botinc-agent]

Problem

Two release promises had no check behind them.

• The released OpenAPI document accepts 31 webhook event names (including auth.* and investigator.*), but the fixture suite exercises 12. Nothing proved a correctly signed delivery for the other 19 verifies, keeps its webhook_type, and preserves the body.
• Nothing in the repository checked that the version release-please writes to pyproject.toml, .release-please-manifest.json and uv.lock matches didit.__version__. release.yml refuses a tag that disagrees, so a stale file turns a release red only after the tag exists.

Solution

• Add tests/test_release_contract.py, parametrised over every WebhookEvent value in openapi/verification.json: sign a body with both signature schemes, verify it, and assert the event type, authentication and payload. Events outside the DESIGN 9.4 typed set must arrive as UnknownEvent with the whole body.
• Assert the hand-written typed-event registry is exactly the DESIGN 9.4 list, so a new typed event stays a deliberate design change.
• Assert __version__, the project version, the release-please manifest and the locked didit-sdk version agree.

No runtime behaviour changes.

Verification

uv run pytest (890 passed, 4 live tests skipped without DIDIT_SANDBOX_API_KEY), the 90% coverage gate, ruff check, ruff format --check, mypy, pyright, and codegen/generate.py --check. The new tests also pass on Python 3.10 and 3.14. Staging session creation could not run: this checkout has no staging API key.