Retried webhooks are not a rare case

Payment providers retry on any non-2xx, including the ones caused by your own deploy. A handler that provisions on every delivery will double-provision eventually, not as an edge case but on a normal Tuesday. Idempotency keys on the handler cost an afternoon; finding out the other way costs a refund and the trust.