docs(order): sign Webhook-Id, Webhook-Timestamp, and UCP-Agent in the webhook signature

[vishkaty]

Problem

The order event webhook lists Webhook-Id and Webhook-Timestamp as required headers and states that headers follow Standard Webhooks, but the signing and verification steps never cover them, and the example Signature-Input signs only @method, @authority, @path, content-digest, and content-type.

Webhooks carry no Idempotency-Key, so Webhook-Id and Webhook-Timestamp are the only per-delivery replay signal. As written, a captured, validly signed delivery can be replayed with an altered Webhook-Id or Webhook-Timestamp, defeating any dedup or freshness check keyed on them.

Fix

The overview verification gate is a closed set (ucp-agent, signature-agent, idempotency-key) with the clause "a header added to UCP later is gate-required only if its defining section says so." This PR has the order webhook section say so:

• Webhook-Id and Webhook-Timestamp MUST be covered components; platforms MUST verify their coverage and MUST deduplicate on Webhook-Id.
• Update the signing and verification steps and the example Signature-Input accordingly.

The example also now covers ucp-agent. The overview gate already requires it whenever the UCP-Agent header is present, and the example carried the header without covering it; adding it binds the signer identity on the webhook. This subsumes the webhook-example change proposed in #568 (that PR additionally covers ucp-agent in a checkout-rest.md request example, which is left to it).

It also drops the stale event_id/created_time from the example body and the playground payload builder (moved to headers in #342), and shows the required headers in the example.

Verification

validate_examples.py and ucp-schema lint unaffected (the change touches an http example and prose, not validated JSON). Playground eventId/eventTime remain used elsewhere (no dead vars).