I'd like to use Lead.Id in a webhook call that will do some work outside of marketo, update the lead record custom field, and then push the lead record into a campaign. However I'm not seeing this field exposed as a token. I could use email address but there is a chance of duplicates and updating the wrong lead record. How are others handling this edge case?

It's just {{Lead.Id}} -- you seem to already know this!