Webhook callback signature is computed over different bytes than the ones sent

Every job with a callback_url gets its result delivered there, HMAC-signed, specifically so a receiver can trust the payload wasn't forged or tampered with in transit. Right now the signature sent in X-Signature is computed over a different serialization of the payload than the bytes actually transmitted. Any receiver correctly implementing "verify the signature against the raw body you received" -- the only correct way to verify an HMAC -- will reject every single callback this service ever sends as unauthentic. This isn't a one-in-a-while flake -- it's a deterministic 100% failure rate for every integration built against this feature, the kind of bug that would only surface once a real client starts actually checking signatures instead of trusting the callback blindly.

body (compact separators, no spaces) is what's actually sent as the request content. The signature is computed over a second, independent json.dumps(payload) call using default separators (with spaces) -- a different byte sequence for the same logical dict.

1. pytest practice_tickets/tests/test_ticket_11_callback_signature_wrong_bytes.py -v
2. Or manually: compare json.dumps(payload, separators=(",", ":")) (the bytes actually sent) against json.dumps(payload) (the bytes signed) for any payload with more than one key.
3. Observe: two visibly different byte strings -- the signature is computed over bytes that were never actually sent.

This is a two-serializations-of-one-value bug: body and the argument to sign() both start from the same payload dict but take two different, independently-written paths to bytes. Nothing enforces that two calls to json.dumps on the same input produce the same output -- they don't, by design. The fix isn't "call json.dumps correctly" so much as "sign the bytes that already exist, don't reserialize." This also fails tests/test_callback.py::test_completion_delivers_signed_callback in the project's own suite.

Look at how sign() is called: what it receives as its body argument right now, versus the body variable already computed two lines above it in the same function. The fix should mean sign() is only ever called with bytes that are also, unmodified, what gets passed to client.post(..., content=...).