Run webhooks with the owner's rules again

The owner sets a webhook up and its URL is a secret, and a webhook run
already refuses every action that needs approval, so holding it to the
API write allowlist only broke the owner's own automations. Webhook runs
no longer count as external callers; schedules keep their caller rules.
The allowlist copy no longer names webhooks.

tests/worker/test_agent_workers.py

@@ -75,8 +75,9 @@ class TestAgentWebhookWorker:
         assert captured["input"] == '{"event": "ping"}'
         # Webhook caller should pass endpoint='webhook'.
         assert captured["kwargs"].get("endpoint") == "webhook"
-        # The payload comes from outside: nobody there can approve for the owner.
-        assert captured["kwargs"].get("external_caller") is True
+        # The owner set the webhook up (its URL is a secret): the run keeps the
+        # owner's rules, and headless runs still refuse approval-gated tools.
+        assert not captured["kwargs"].get("external_caller")
 
     def test_missing_agent_raises(
         self, pg_conn, patch_worker_db, task_self, monkeypatch