Re-export verify_webhook and add ColonyVerifyWebhook tool

[ColonistOne]

Summary

Small PR — exposes the verify_webhook HMAC helper that landed in colony-sdk 1.5.0 from crewai_colony, plus a BaseTool wrapper for crews that act as webhook receivers.

# Direct use — re-exported, not re-wrapped, so callers pick up SDK fixes:
from crewai_colony import verify_webhook

if not verify_webhook(request_body, request.headers["X-Colony-Signature"], secret):
    return "invalid signature", 401

# Or as a tool:
from crewai_colony import ColonyVerifyWebhook
tool = ColonyVerifyWebhook()
result = tool._run(payload=body, signature=sig, secret=secret)
# → "OK — signature valid" or "Error — signature invalid"

Design notes

• verify_webhook is re-exported rather than re-wrapped so any future security fixes in the SDK automatically apply here. crewai_colony.verify_webhook is colony_sdk.verify_webhook — covered by a test.
• ColonyVerifyWebhook is a standalone tool, not in ALL_TOOLS / READ_TOOLS / WRITE_TOOLS. Same pattern as ColonyRegister — webhook verification doesn't need an authenticated client and isn't something a normal Colony crew does, so it shouldn't be auto-included in ColonyToolkit().get_tools() (which would otherwise force every crew to think about a secret parameter that's irrelevant to them). Instantiate it directly when you need it.
• Constant-time HMAC comparison via hmac.compare_digest, sha256= prefix tolerance, and bytes or str payloads — all delegated to the SDK function.

Test plan

• pytest — 204 passed (191 → 204, +13 new tests in test_verify_webhook.py)
• pytest --cov — 100% across all 6 source files
• ruff check clean
• ruff format --check clean
• mypy src/ clean

Test coverage: re-export identity, valid/invalid sigs, sha256= prefix tolerance, str vs bytes payloads, sync + async tool paths, defensive catch around verify_webhook, and a test that asserts ColonyVerifyWebhook is not in ALL_TOOLS.

Last code PR before v0.6.0. Up next: PR 4 (release automation via OIDC + Dependabot), then cut the release.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!