Branching webhook 401s when notify-url points to an Edge Function on a different project

# Bug report - [x] I confirm this is a bug with Supabase, not with my own application. - [x] I confirm I have searched the [[Docs](https://docs.supabase.com/)](https://docs.supabase.com), GitHub [[Discussions](https://github.com/supabase/supabase/discussions)](https://github.com/supabase/supabase/discussions), and [[Discord](https://discord.supabase.com/)](https://discord.supabase.com). ## Describe the bug Branching webhooks (`--notify-url`) cannot target an Edge Function hosted on a **different** Supabase project. The webhook request is sent with an `apikey` header containing the **source** project's publishable key. When the notify URL points to an Edge Function on another project (a dedicated "DevOps" project), that project's API gateway rejects the request with `401 UNAUTHORIZED_INVALID_API_KEY` — because the key belongs to the source project, not the target one. The Edge Function code never executes. This makes it impossible to decouple product projects from a central DevOps/observability project when consuming branching events. ## To Reproduce 1. Have two Supabase projects: `MAIN` (product, with branching enabled) and `DEVOPS`. 2. Deploy an Edge Function on `DEVOPS`, e.g. `notify-slack`. 3. Configure the branching webhook on `MAIN`: ```bash supabase branches update main --notify-url https://<DEVOPS_PROJECT_REF>.supabase.co/functions/v1/notify-slack ``` 4. Trigger a branching event (e.g. push to a branch / merge to main). 5. Inspect the Edge Function logs on `DEVOPS`: the request never reaches the function. Observed in the request/response logs: Request header injected by the webhook (source project's key): ```json "request.sb.apikey.apikey.prefix": "sb_publishable_$MAIN_PROJECT_PUBLISHABLE_KEY" ``` Response from the `DEVOPS` gateway: ```json "response.headers.sb_error_code": "UNAUTHORIZED_INVALID_API_KEY" ``` ## Expected behavior One of: - The branching webhook should not inject the source project's `apikey` header when the notify URL is not the sourc…