Add auth-integration-engineer and webhook-engineer subagents

[Sabeekhann]

Adds two subagents to 01-core-development, both targeting workflows that no existing agent currently owns.

Why these two

I audited all 158 existing agents (every agent's name/description frontmatter, plus keyword sweeps across categories/) before picking, specifically to avoid overlap:

Workflow	Current ownership	Evidence
Implementing auth (OAuth/OIDC/SAML, sessions, multi-tenancy)	none — security-engineer, security-auditor and penetration-tester audit security posture; none build identity flows	SAML: 0 files, OIDC: 1 file
Webhook delivery and consumption	none — appears as a stray bullet inside other agents, owned by no one	webhook: 10 files, 0 own it

Both are protocol/integration implementation agents, so they sit naturally alongside api-designer and websocket-engineer rather than in a security or vertical category.

auth-integration-engineer

Scoped deliberately to building auth, not auditing it — that boundary is what keeps it from colliding with security-engineer / security-auditor.

Covers OAuth 2.1/OIDC with PKCE, token strategy (rotation, reuse detection, signature/issuer/audience validation), session and cookie lifecycle, SAML 2.0 assertion validation and SCIM provisioning for enterprise SSO, multi-tenant authorization models, and MFA/WebAuthn. Includes an explicit "common failure modes" section for the mistakes that actually ship — unvalidated state, missing nonce, alg: none, open redirect on callback, tenant ID read from the request body instead of the verified token.

webhook-engineer

Covers both sides of the boundary, since most real bugs live at that seam.

Consuming: raw-body HMAC verification (verify before parsing — the classic bug), constant-time comparison, timestamp tolerance, fast-ack with async processing. Plus idempotency under at-least-once delivery, out-of-order arrival handling, retry/backoff with jitter, dead-letter queues with replay tooling, and reconciliation against the provider API as source of truth. Producing: event versioning, per-subscriber backoff, secret rotation, and SSRF hardening on delivery to subscriber-controlled URLs.

Files updated per CONTRIBUTING.md

• categories/01-core-development/auth-integration-engineer.md (new)
• categories/01-core-development/webhook-engineer.md (new)
• Main README.md — added to the Core Development list in alphabetical order; count badge and intro line 158 → 160 (verified against the actual file count, which was exactly 158 before this PR)
• categories/01-core-development/README.md — descriptions with Use when: lines, two Quick Selection Guide rows, two new Common Combinations
• categories/01-core-development/.claude-plugin/plugin.json — both agents added to agents, version 1.0.2 → 1.0.3
• .claude-plugin/marketplace.json — voltagent-core-dev version synced to 1.0.3, keywords extended

Verification

• Both files follow the category template (frontmatter → intro → When invoked → checklists → Communication Protocol → 3-phase workflow → integration list), structurally diffed against api-designer.md and websocket-engineer.md
• Alphabetical ordering confirmed in both READMEs and the agents array
• Both JSON files parse; plugin and marketplace versions match
• All 160 agent names unique — no collisions
• Every agent named in the "Integration with other agents" sections resolves to a real file in this repo