obs: port worker observability + buildinfo from api repo (B1)

[mastermanas805]

Summary

Relocates the worker observability code that was merged into the api repo
under api/worker/ (PR #37 there) into its real home in this repo. Switches
from the temporary _obs_stubs/{buildinfo,logctx} packages to the canonical
instant.dev/common/{buildinfo,logctx} packages.

Why

The api repo PR #37 shipped the observability scaffolding for the worker
but in the wrong git history because the orchestrator created the worktree
against InstaNode-dev/api rather than InstaNode-dev/worker. Production
instant-worker k8s Deployment runs an image built from THIS repo, so the
obs code never reached the running worker.

Today's PR #40 on the api repo also did the _obs_stubs -> common switch.
This PR mirrors that fix for the worker.

What ships

• internal/jobs/middleware.go -- WithObservability[T] generic River-Worker
  wrapper. Stamps tid / trace_id on ctx via logctx, opens optional New
  Relic transaction, logs duration on completion. Fail-open on nil nrApp.
• internal/jobs/middleware_test.go -- 7 tests + 1 subtest (8 total):
  tid stamping, trace_id missing/preserved, error propagation, nil-NR safe
  (success + failure), delegation of NextRetry/Timeout, int64 formatter.
• internal/obs/nr.go -- InitNewRelic returning (nil, nil) on missing
  NEW_RELIC_LICENSE_KEY. Never crashes.
• internal/obs/nr_test.go -- 2 tests (fail-open, nil-safe).
• main.go -- slog wrapped in logctx.NewHandler("worker", base); NR
  init + Shutdown defer; /healthz now returns commit_id / build_time
  / version from buildinfo; StartWorkers receives nrApp.
• internal/jobs/workers.go -- StartWorkers signature gains
  nrApp *newrelic.Application. Every river.AddWorker(...) wraps the
  worker via WithObservability(...).
• Dockerfile -- bumped to golang:1.25-alpine to match go.mod.

Imports refactor (stubs -> common)

instant.dev/worker/internal/_obs_stubs/buildinfo -> instant.dev/common/buildinfo
instant.dev/worker/internal/_obs_stubs/logctx    -> instant.dev/common/logctx

The replace instant.dev/common => ../common directive already in go.mod
makes the canonical imports resolve to the sibling checkout.

Note: instant.dev/common/logctx.NewHandler takes (service, base) not
(service, commit_id, base). The canonical handler reads commit_id from
COMMIT_ID env (fallback "dev"); buildinfo.GitSHA is read separately for
the /healthz payload. To make the log fields agree with /healthz, the k8s
Deployment should set COMMIT_ID=$GIT_SHA env var (not done in this PR).

Tests

$ go test ./internal/jobs/ ./internal/obs/ -count=1 -v
...
--- PASS: TestWithObservability_StampsTIDOnContext (0.00s)
--- PASS: TestWithObservability_SetsTraceIDWhenMissing (0.00s)
--- PASS: TestWithObservability_PreservesExistingTraceID (0.00s)
--- PASS: TestWithObservability_PropagatesError (0.00s)
--- PASS: TestWithObservability_NilNRAppIsSafe (0.00s)
    --- PASS: TestWithObservability_NilNRAppIsSafe/success
    --- PASS: TestWithObservability_NilNRAppIsSafe/failure
--- PASS: TestWithObservability_DelegatesNextRetryAndTimeout (0.00s)
--- PASS: TestJobIDString (0.00s)
... (24 pre-existing tests) ...
ok      instant.dev/worker/internal/jobs        0.768s
--- PASS: TestInitNewRelic_FailOpenOnMissingLicenseKey (0.00s)
--- PASS: TestWaitForConnection_NilSafe (0.00s)
ok      instant.dev/worker/internal/obs         0.364s

34 PASS, 0 FAIL.

Live deploy verification

Image: ghcr.io/mastermanas805/instant-worker:v1.5.0-obs-20ee825 (linux/amd64, 36.9 MB).

$ kubectl rollout status deployment/instant-worker -n instant-infra --timeout=180s
deployment.apps/instant-worker image updated
Waiting for deployment "instant-worker" rollout to finish: 1 out of 2 new replicas...
...
deployment "instant-worker" successfully rolled out

$ kubectl port-forward -n instant-infra pod/instant-worker-f76647fc4-nctcj 18182:8091 &
$ curl http://localhost:18182/healthz
{"ok":true,"service":"instant-worker","commit_id":"20ee825","build_time":"2026-05-12T17:45:54Z","version":"v1.5.0-obs"}

commit_id=20ee825 matches the head SHA -- ldflag injection works end-to-end.

Container name in Deployment spec: worker.

Test plan

• go test ./... passes
• go build ./... clean
• docker buildx build linux/amd64 succeeds
• image pushed to ghcr.io
• kubectl rollout completes
• /healthz returns ldflag-injected commit_id
• log lines include service + commit_id + trace_id + tid + team_id

Pushback

1. Cluster had a transient DNS flake during the first rollout attempt
   (postgres-platform.instant.svc.cluster.local failed to resolve, then
   resolved on retry). Not caused by this PR -- pre-existing condition.

2. instant.dev/common/logctx.NewHandler ignores buildinfo.GitSHA and
   reads commit_id from the COMMIT_ID env var. Until the k8s manifest
   sets COMMIT_ID=$GIT_SHA per deploy, log lines show commit_id=dev
   while /healthz shows the real SHA. Fix: either update the worker k8s
   Deployment env, or change common/logctx to fall back to
   buildinfo.GitSHA -- the latter is the cleaner long-term fix and
   belongs in a common-repo PR.

3. go mod tidy against the local Go 1.26 toolchain bumped go 1.24.0
   to go 1.25. Bumped Dockerfile to golang:1.25-alpine to match;
   verified the build still produces a working binary.

Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

(Generated with Claude Code)