"`The tenant admin disabled this bot" / no webhooks delivered upon installation

I am trying to create a Teams app with a notification bot. I have done the following:

1. create a multi-tenant entra registration and added a client secret
2. create an azure bot and using the client ID of the above registration
3. Added Teams a channel
4. Set an endpoint of https://app.getmycompany-staging.com/microsoft/bot
5. Uploaded this manifest (says its valid in dev.teams.microsoft.com)

{
  "$schema": "https://developer.microsoft.com/en-us/json-schemas/teams/v1.19/MicrosoftTeams.schema.json",
  "manifestVersion": "1.19",
  "version": "1.0.0",
  "id": "
  "developer": {
    "name": "mycompany",
    "websiteUrl": "https://getmycompany.com",
    "privacyUrl": "https://getmycompany.com/privacy",
    "termsOfUseUrl": "https://getmycompany.com/terms"
  },
  "icons": {
    "color": "color.png",
    "outline": "outline.png"
  },
  "name": {
    "short": "My company Surveys",
    "full": "mycompany Quarterly Surveys"
  },
  "description": {
    "short": "Quarterly survey reminders from mycompany.",
    "full": "mycompany sends each team member a reminder to complete their quarterly survey. Once installed to a team, mycompany reads the team roster and sends individual reminders to anyone who hasn't yet completed the survey."
  },
  "accentColor": "#0066CC",
  "bots": [
    {
      "botId": "
      "scopes": [
        "personal",
        "team"
      ],
      "supportsFiles": false,
      "isNotificationOnly": false
    }
  ],
  "webApplicationInfo": {
    "id": "
    "resource": "api://getmycompany-staging.com/
  },
  "validDomains": [
    "app.getmycompany-staging.com"
  ],
  "authorization": {
    "permissions": {
      "resourceSpecific": [
        {
          "name": "TeamMember.Read.Group",
          "type": "Application"
        }
      ]
    }
  }
}

[Moderator note: personal info removed] 

For my teams instance that is in the same tenant as where the bot and app registration are created:

The app successfully uploads in admin.teams.microsoft.com
The app successfully sideloads within the Teams UI
The app says it is installed for me personally

for sanity purposes:
My GET endpoint of https://app.getmycompany-staging.com/microsoft/bot returns a 200 always
My POST endpoint of https://app.getmycompany-staging.com/microsoft/bot returns a 200 always
there is no auth on it

I have checked the following

• app permission policy (available to all)
• org settings (allows custom apps)
• looked for anything in messaging policy that is off (have never touched it)
• I am a global admin
• multiple hours have passed since resource creation
• all setup policies (all allow custom apps)
• the Teams I install it to show it as an app, I can also tag the app in a message in the messages

I can see my GET endpoint get hit anytime I open the "Configuration" tab of my Azure Bot as it does a ping.
I can see my POST endpoint get hit from the webchat test when I send a message

I do not see any other webhooks come through.

Validating I have credentials and my app can authenticate (even though it's not receiving anything that should trigger it) I am able to get an access token through
curl -k -X POST "https://login.microsoftonline.com/botframework.com/oauth2/v2.0/token" \

-d "grant_type=client_credentials" \

-d "client_id=${APP_ID}" \

-d "client_secret=${APP_SECRET}" \

-d "scope=https://api.botframework.com/.default"

When I am trying to do installations I see the same "the tenant admin disabled this bot"

I've hired multiple people on Upwork, gone through support on the MS Teams part, no one can figure it out. Spent hours with Claude, Gemini, etc. Have tried following this blog post and do not see "the tenant admin disabled this bot" but just don't see any sign whatsoever of webhooks coming through.

Trying to fill out a support request MS runs diagnostics and says it's getting a 401, which it treats as a 502, but I see nothing in my logs while it runs those diagnostics.