I think the root problem is that this notification behaves the wrong way.
Normally commit notification such as to /git/notifyCommit simply asks Jenkins to perform polling immediately: the notification is not trusted, just taken as a hint. Then the workflow job knows how to poll properly when multiple repositories were checked out.
But if the webhook tries to schedule a build immediately,
as happens when you specify a commit hash, then this cannot work. Possibly Jenkins core needs to get an API so that you can schedule polling while still suggesting a particular commit to build. Then the Git plugin would need to use this API, so that when polling is actually run, the proposed commit would be verified as legitimate and then used to check out. This would work correctly for a project with multiple repositories, because the commit hash would be rejected as nonexistent in unrelated repositories.
The real solution is probably to move away from the enforced commit hash model altogether, and instead use the multibranch API plugin to support repositories which might offer new heads on various branches.