test(spec): sync proof-registry test to the webhook-materialization bound class (#3490)

The registry's BOUND_PROOF_PATHS expected-list and the real-proof-wiring
`ledgerFor` map must be updated in lockstep when a bound high-risk class is added
— add `webhook/object` and the `webhook` → webhook.json ledger path. The Test
Core failure on the first push was exactly this lockstep assertion doing its job.

(Validate Package Dependencies is red on OSV-Scanner audit hits for pre-existing
transitive deps — next / react-router / sharp / tar / js-yaml / brace-expansion —
none introduced here; that job is not a required check and is triggered only
because this PR touches pnpm-lock.yaml to add the dogfood workspace deps.)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: os-zhuang

packages/spec/scripts/liveness/proof-registry.test.ts

@@ -112,6 +112,7 @@ describe('registry invariants', () => {
         'object/sharingModel',
         'position/delegatable',
         'object/lifecycle',
+        'webhook/object',
       ].sort(),
     );
   });
@@ -133,6 +134,7 @@ describe('real proof wiring resolves', () => {
     dataset: 'packages/spec/liveness/dataset.json',
     object: 'packages/spec/liveness/object.json',
     position: 'packages/spec/liveness/position.json',
+    webhook: 'packages/spec/liveness/webhook.json',
   };
 
   function ledgerEntry(type: string, path: string): any {