Blue-green cutover misses webhook callback allowlist

The new stack goes live, but one callback provider still points at the old address because its allowlist and DNS cutover are out of sync.