fix(webhooks): parse simplified payload and preserve bot owners (node)

[KonstantinSerebryakov]

Current identification.scored payloads repeat detection data across signals, risk_events and flags, expose two OS mismatch keys, and lack HRE cluster references and bot owner labels. This change adopts schema 2026-10-07: one public os_mismatch, no current risk_events or fingerprint/HRE mirrors, nullable authoritative hre.*.cluster_id, and optional bot owner labels. request_id remains the scan/API join key; event_id remains the retry deduplication key. Owner identifies the provider company (for example OpenAI); agent/product attribution stays separate in client_identity.

Preserves optional provider labels and HRE cluster references in the supported client parser/model. Current fixtures omit risk_events, fingerprint and os_mismatch2; old parsers remain for compatibility. Refreshes the vendored OpenAPI definition and current schema constant.

Stacked on #9. Merge the parent contract first.

Validation: Typecheck and all 675 tests pass. Tests ran in a temporary copy because Vite mishandles the # character in the workspace path. No package publishing.

Related contract changes:

• Shield.Core
• Shield.Portal.Admin
• Shield.Docs
• shieldlabs-openapi
• shieldlabs-go
• shieldlabs-python
• shieldlabs-php