Those ranges only cover LiveKit’s own realtime/SIP/webhook traffic your shutdown callback egresses from the agent container instead, and LiveKit doesn’t publish IPs for that yet (What are the egress IPs for Agents Cloud compute containers?), so there’s nothing more you can whitelist.
Also, an IP block would give you a timeout, not a 403 that’s an L7 WAF or auth rejecting you. Easiest fix is to drop the IP rule on that path and authenticate the webhook with an HMAC or shared-secret header.