Other endpoints

The gateway invokes the control plane's webhook receiver by name, under the gateway-invoke role it assumes by OIDC federation. The receiver verifies each sender's signature itself; this route adds no authentication of its own, because the senders are SaaS products that sign payloads rather than carry credentials.