Normalize outbound webhook query bounds to UTC

[Chris0Jeky]

Purpose

Take the next bounded #1422 timestamp-audit slice identified by the coordinator after #2646. Both outbound-webhook polling queries compare a caller-supplied DateTimeOffset against SQLite TEXT columns without normalizing the bound. EF's SQLite mapping preserves the source offset, so two values representing the same instant can sort differently as text.

This PR covers the two read bounds only:

• GetDuePendingAsync(now) against NextAttemptAt;
• GetStuckProcessingAsync(staleBefore) against LastAttemptAt.

TDD checkpoint

The first commit is regression-only. It stores each boundary at 10:00 +00:00, queries with the exact same instant represented as 08:00 -02:00, and requires the row to remain due/stuck. Current SQLite raw SQL binds the offset-preserving value, so both focused cases are intentionally expected to fail before normalization.

Scope

• Query-bound normalization only; no stored row, inequality, ordering, limit, worker cadence, subscription loading, claim, retry, or delivery behavior changes.
• The remaining LlmUsageRecordRepository and optimistic-equality claim sites listed on Audit DateTimeOffset-vs-TEXT comparison sites for missing UTC normalization (convention-only invariant after #1403/#1421) #1422 remain outside this PR.

Refs #1422

[Chris0Jeky]

Fresh-context review: CLEAN at exact head 01b52dad1d7d5ac4e5e00d8c97001f3792813c3c against current main 8082a602db24fc3060a63b956c252d510d2faec8.

SQLite due/stuck query bounds are normalized to UTC while preserving inclusive boundary semantics; production callers and persisted delivery timestamps already use UTC. The corrected fixtures remain unique and are 33/35 characters, within the 50-character domain limit. No realistic CRITICAL/HIGH blocker was found.

Independent evidence: 2/2 boundary tests, 3/3 existing repository tests, 77/77 webhook-focused API tests, and git diff --check pass. Non-SQLite direct callers with non-UTC inputs remain outside this SQLite-scoped fix and are non-blocking follow-up territory. Hosted CI and the normal ready-state connector review remain required.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-16T18:05:08.546900Z	01b52da	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.