Align retained webhook clear control with upstream normalization

The combined-tree race check exposed the retained clear-header fixture still expecting an empty Content-Type. Upstream correctly removes cleared headers so the JSON default survives; align only that fixture expectation, and fix the strict helper comment. Preserve source-rs9sv1rz failure and do not change production normalization or rejection behavior.

Contract-Neutral: Test expectation and helper-comment reconciliation only; cleared header normalization is already supplied by reviewed upstream.
Change-source: pulse-maintainer

internal/api/alerting/notifications.go

@@ -510,7 +510,7 @@ func (h *NotificationHandlers) CreateWebhook(w http.ResponseWriter, r *http.Requ
 	}
 }
 
-// restoreMaskedWebhookValues resolves only submitted placeholders. The editor
+// restoreStrictMaskedWebhookValues resolves only submitted placeholders. The editor
 // sends a replacement map: explicit edits and omitted keys must not be undone
 // just because another value is still masked. Header names are case-insensitive;
 // custom-field names are not. Never store a placeholder without a saved value.

internal/api/alerting/notifications_test.go

@@ -1418,7 +1418,7 @@ func TestWebhookEditPreservesOnlyMaskedValues(t *testing.T) {
 			map[string]string{"token": "synthetic-token", "channel": "new", "added": "new"}, false},
 		{"clear beside masks", map[string]string{"Authorization": masked, "Content-Type": ""},
 			map[string]string{"token": masked, "channel": ""},
-			map[string]string{"Authorization": "synthetic-auth", "Content-Type": ""},
+			map[string]string{"Authorization": "synthetic-auth"},
 			map[string]string{"token": "synthetic-token", "channel": ""}, false},
 		{"header case is insensitive", map[string]string{"authorization": masked}, map[string]string{"token": masked},
 			map[string]string{"authorization": "synthetic-auth"}, map[string]string{"token": "synthetic-token"}, false},