Our webhook dedupe check was a race, not a guard

We deduplicated webhooks the obvious way. Handler receives an event, runs SELECT on processed_events...