An unguessable capability URL is the whole credential (closes #52)

The HTTP hardening section ends with "when in doubt, harden", which as
written authorises adding HMAC signing or a shared secret on top of an
endpoint already gated by an unguessable per-entrypoint UUID URL. That
has been ruled against twice, and inbound signature verification was
removed from webhooker on exactly that reasoning; until now the only
text contradicting the policy was webhooker's own README.

Adds one scoped carve-out immediately after that sentence: such a URL is
a complete credential and gets no second factor, not even as defence in
depth. The consequences that do follow — keep it out of logs and
tickets, rotate by minting a new entrypoint — are stated, as is what to
do with a sender that only supports signed payloads. Nothing in the
surrounding hardening guidance is removed or weakened.

TODO.md

@@ -21,6 +21,9 @@ fmt-check, and commit.
 
 # Completed Steps
 
+- 2026-08-25: Carved capability-URL services out of "when in doubt, harden" in
+  REPO_POLICIES.md: an unguessable per-entrypoint UUID URL is a complete
+  credential and gets no second authentication factor.
 - 2026-08-10: Moved every lint run into a container. `script/lint` now runs the
   linter directly when `LINT_IN_CONTAINER=1` and otherwise builds
   `Dockerfile.lint`, so the linter never runs on a developer host — closing the