Debrief (webhook)

Sent only when the final verdict differs from the provisional one.

POST /your/webhook
DoubleAgent-Signature: t=1758614400,v1=5f8a…

{ "id": "evt_…", "type": "verdict.final", "created": 1758614400,
  "data": { "sid": "s_…", "site": "st_…", "provisional": "human",
            "verdict": { "class": "agent", … }, "ids": { "ga_client_id": "…" } } }

const event = await da.verifyWebhook(req.body /* raw */, req.get('DoubleAgent-Signature'), process.env.DOUBLEAGENT_WEBHOOK_SECRET);

Signature: hex(HMAC-SHA256(secret, t + "." + rawBody)). Reject timestamps older than 300 s.