refactor(source): dedup shared helpers across static + dockerfile plugins

Extract the verbatim-duplicated helpers into shared homes:
- buildEnv -> plugin.BuildWorkloadEnv (base plugin pkg; a sourceName param
  preserves each plugin's slog prefix / log-scraper text)
- idShort -> plugin.IDShort
- commitStatusReporter -> staticsite.CommitStatusReporter, re-parameterized
  on primitives (owner/repo/sha/targetURL/enabled) so staticsite needs no
  dependency on the plugin package; reporter tests ported to staticsite
  (plus a new nil-provider case)

containerNameFor/imageTagFor are intentionally left per-plugin: their
prefixes differ (dw-site- vs tf-build-) and name real Docker resources,
so merging them would risk mis-routing. Behavior-preserving; the
static/dockerfile test suites pass unchanged.

Reviewed: go APPROVE (0 CRITICAL/HIGH).

internal/workload/plugin/naming.go

@@ -0,0 +1,17 @@
+package plugin
+
+// IDShort returns the first 8 chars of a workload ID, used as the uniqueness
+// suffix on the Docker resources (container, image, volume) a source plugin
+// materializes. Workload names are not UNIQUE in the schema today; including
+// the ID short prevents two workloads with the same name from clobbering each
+// other's container, image, or storage volume.
+//
+// Shared by the source plugins (static, dockerfile). Each plugin still owns
+// its own container/image NAME format (the human-readable prefix differs by
+// source kind) — only the ID-short derivation is common.
+func IDShort(w Workload) string {
+	if len(w.ID) < 8 {
+		return w.ID
+	}
+	return w.ID[:8]
+}