refactor(spec): one-line credential markers on WebhookSchema

Claude-Session: https://claude.ai/code/session_01D6F9axfoPzR7t8G1J7Ytzz
Co-authored-by: Claude <noreply@anthropic.com>

Author: claude

packages/spec/src/automation/webhook.zod.ts

@@ -200,8 +200,7 @@ export const WebhookSchema = lazySchema(() => strictObject({
    * schema-derived redactor in `kernel/metadata-type-redaction.ts` is what
    * reads this marker (ruling B+ on #24966).
    */
-  headers: z.record(z.string(), z.string()).optional().describe('Custom HTTP headers')
-    .meta({ credential: 'map' }),
+  headers: z.record(z.string(), z.string()).optional().describe('Custom HTTP headers').meta({ credential: 'map' }),
 
   /** Timeout */
   timeoutMs: z.number().int().min(1000).max(300000).default(30000).describe('Request timeout in milliseconds'),
@@ -213,8 +212,7 @@ export const WebhookSchema = lazySchema(() => strictObject({
    * reads the declaration itself, never a served copy, so delivery signing is
    * unaffected.
    */
-  secret: z.string().optional().describe('Signing secret for HMAC signature verification')
-    .meta({ credential: 'value' }),
+  secret: z.string().optional().describe('Signing secret for HMAC signature verification').meta({ credential: 'value' }),
 
   /** Status */
   isActive: z.boolean().default(true).describe('Whether webhook is active'),