Blocking all of `/.well-known/workflow/` breaks `createWebhook()`, whose
`webhook/:token` route is a sibling under the same prefix and is meant to be
reachable by the caller. Also note that WORKFLOW_PUBLIC_MANIFEST is read at
build time, and attribute payload validation to the runtime rather than the
queue handler, which only checks the header shape and queue-name prefix.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Peter Wielander
165c02979d