refactor(source): dedup shared helpers across static + dockerfile plugins

Extract the verbatim-duplicated helpers into shared homes:
- buildEnv -> plugin.BuildWorkloadEnv (base plugin pkg; a sourceName param
  preserves each plugin's slog prefix / log-scraper text)
- idShort -> plugin.IDShort
- commitStatusReporter -> staticsite.CommitStatusReporter, re-parameterized
  on primitives (owner/repo/sha/targetURL/enabled) so staticsite needs no
  dependency on the plugin package; reporter tests ported to staticsite
  (plus a new nil-provider case)

containerNameFor/imageTagFor are intentionally left per-plugin: their
prefixes differ (dw-site- vs tf-build-) and name real Docker resources,
so merging them would risk mis-routing. Behavior-preserving; the
static/dockerfile test suites pass unchanged.

Reviewed: go APPROVE (0 CRITICAL/HIGH).

internal/workload/plugin/source/dockerfile/deploy.go

@@ -95,16 +95,16 @@ func deploy(ctx context.Context, deps plugin.Deps, w plugin.Workload, intent plu
 	// (deployStarted). The unchanged-SHA short-circuit below returns via
 	// healUnchanged before that flips, so no status is reported when
 	// nothing was built. retErr is the named return the defer inspects.
-	reporter := newCommitStatusReporter(provider, cfg, latestSHA, statusTargetURL(domain))
+	reporter := staticsite.NewCommitStatusReporter(provider, cfg.RepoOwner, cfg.RepoName, latestSHA, statusTargetURL(domain), cfg.ReportCommitStatus)
 	deployStarted := false
 	defer func() {
 		if !deployStarted {
 			return
 		}
 		if retErr != nil {
-			reporter.report(ctx, w, staticsite.CommitStatusFailure, "Tinyforge: build failed")
+			reporter.Report(ctx, w.Name, w.ID, staticsite.CommitStatusFailure, "Tinyforge: build failed")
 		} else {
-			reporter.report(ctx, w, staticsite.CommitStatusSuccess, "Tinyforge: deployed")
+			reporter.Report(ctx, w.Name, w.ID, staticsite.CommitStatusSuccess, "Tinyforge: deployed")
 		}
 	}()
 
@@ -153,13 +153,13 @@ func deploy(ctx context.Context, deps plugin.Deps, w plugin.Workload, intent plu
 	updateStatus(deps, w, "syncing", prev.LastCommitSHA, "")
 	publishEvent(deps, w, "syncing")
 	deployStarted = true
-	reporter.report(ctx, w, staticsite.CommitStatusPending, "Tinyforge: deploying")
+	reporter.Report(ctx, w.Name, w.ID, staticsite.CommitStatusPending, "Tinyforge: deploying")
 
 	// Clone the repo into a temp dir. We always download the entire
 	// repo tree (folderPath = ""); a ContextPath subset is applied
 	// at build time, not at download time, so a Dockerfile in
 	// `./docker/Dockerfile` with `ContextPath=""` still works.
-	cloneDir, err := os.MkdirTemp("", "tf-build-"+idShort(w)+"-*")
+	cloneDir, err := os.MkdirTemp("", "tf-build-"+plugin.IDShort(w)+"-*")
 	if err != nil {
 		updateStatus(deps, w, "failed", prev.LastCommitSHA,
 			sanitizeError(fmt.Sprintf("create clone dir: %v", err), token))
@@ -205,7 +205,7 @@ func deploy(ctx context.Context, deps plugin.Deps, w plugin.Workload, intent plu
 		return fmt.Errorf("docker build: %w", err)
 	}
 
-	env := buildEnv(deps, w.ID)
+	env := plugin.BuildWorkloadEnv(deps, w.ID, "dockerfile source")
 	containerPort := strconv.Itoa(cfg.Port)
 
 	settings, err := deps.Store.GetSettings()
@@ -394,46 +394,6 @@ func deploy(ctx context.Context, deps plugin.Deps, w plugin.Workload, intent plu
 	return nil
 }
 
-// commitStatusReporter pushes deploy outcomes back to the git provider as
-// a commit status, gated on the per-workload report_commit_status flag.
-// Strictly best-effort: every call is wrapped so a reporting failure is
-// logged at Warn and NEVER propagates to fail or block the deploy. Mirrors
-// the static plugin's reporter of the same name.
-type commitStatusReporter struct {
-	provider  staticsite.GitProvider
-	owner     string
-	repo      string
-	sha       string
-	targetURL string
-	enabled   bool
-}
-
-// newCommitStatusReporter builds a reporter from the decoded config. When
-// report_commit_status is off (or the SHA is empty) the returned reporter's
-// report method is inert.
-func newCommitStatusReporter(provider staticsite.GitProvider, cfg Config, sha, targetURL string) *commitStatusReporter {
-	return &commitStatusReporter{
-		provider:  provider,
-		owner:     cfg.RepoOwner,
-		repo:      cfg.RepoName,
-		sha:       sha,
-		targetURL: targetURL,
-		enabled:   cfg.ReportCommitStatus,
-	}
-}
-
-// report sends one commit status, swallowing (and logging) any error. Safe
-// to call on a disabled reporter or with a nil provider/empty SHA.
-func (r *commitStatusReporter) report(ctx context.Context, w plugin.Workload, status staticsite.CommitStatus, description string) {
-	if r == nil || !r.enabled || r.provider == nil || r.sha == "" {
-		return
-	}
-	if err := r.provider.SetCommitStatus(ctx, r.owner, r.repo, r.sha, status, r.targetURL, description); err != nil {
-		slog.Warn("dockerfile: commit-status report failed (ignored)",
-			"workload", w.Name, "status", string(status), "error", err)
-	}
-}
-
 // statusTargetURL derives the https URL the commit status links back to —
 // the workload's primary public face, or "" when it has none.
 func statusTargetURL(domain string) string {