refactor(source): dedup shared helpers across static + dockerfile plugins

Extract the verbatim-duplicated helpers into shared homes:
- buildEnv -> plugin.BuildWorkloadEnv (base plugin pkg; a sourceName param
  preserves each plugin's slog prefix / log-scraper text)
- idShort -> plugin.IDShort
- commitStatusReporter -> staticsite.CommitStatusReporter, re-parameterized
  on primitives (owner/repo/sha/targetURL/enabled) so staticsite needs no
  dependency on the plugin package; reporter tests ported to staticsite
  (plus a new nil-provider case)

containerNameFor/imageTagFor are intentionally left per-plugin: their
prefixes differ (dw-site- vs tf-build-) and name real Docker resources,
so merging them would risk mis-routing. Behavior-preserving; the
static/dockerfile test suites pass unchanged.

Reviewed: go APPROVE (0 CRITICAL/HIGH).

internal/workload/plugin/source/static/deploy.go

@@ -93,16 +93,16 @@ func deploy(ctx context.Context, deps plugin.Deps, w plugin.Workload, intent plu
 	// short-circuit below returns before that flips, so no status is
 	// reported when nothing was deployed. retErr is the named return the
 	// defer inspects.
-	reporter := newCommitStatusReporter(provider, cfg, latestSHA, statusTargetURL(domain))
+	reporter := staticsite.NewCommitStatusReporter(provider, cfg.RepoOwner, cfg.RepoName, latestSHA, statusTargetURL(domain), cfg.ReportCommitStatus)
 	deployStarted := false
 	defer func() {
 		if !deployStarted {
 			return
 		}
 		if retErr != nil {
-			reporter.report(ctx, w, staticsite.CommitStatusFailure, "Tinyforge: deploy failed")
+			reporter.Report(ctx, w.Name, w.ID, staticsite.CommitStatusFailure, "Tinyforge: deploy failed")
 		} else {
-			reporter.report(ctx, w, staticsite.CommitStatusSuccess, "Tinyforge: deployed")
+			reporter.Report(ctx, w.Name, w.ID, staticsite.CommitStatusSuccess, "Tinyforge: deployed")
 		}
 	}()
 
@@ -140,10 +140,10 @@ func deploy(ctx context.Context, deps plugin.Deps, w plugin.Workload, intent plu
 	updateStatus(deps, w, "syncing", prev.LastCommitSHA, "")
 	publishEvent(deps, w, "syncing")
 	deployStarted = true
-	reporter.report(ctx, w, staticsite.CommitStatusPending, "Tinyforge: deploying")
+	reporter.Report(ctx, w.Name, w.ID, staticsite.CommitStatusPending, "Tinyforge: deploying")
 
 	// Build context — temp dir cleaned up on every exit path.
-	buildDir, err := os.MkdirTemp("", "dw-site-"+idShort(w)+"-*")
+	buildDir, err := os.MkdirTemp("", "dw-site-"+plugin.IDShort(w)+"-*")
 	if err != nil {
 		updateStatus(deps, w, "failed", prev.LastCommitSHA,
 			sanitizeError(fmt.Sprintf("create temp dir: %v", err), token))
@@ -215,7 +215,7 @@ func deploy(ctx context.Context, deps plugin.Deps, w plugin.Workload, intent plu
 		return fmt.Errorf("build image: %w", err)
 	}
 
-	env := buildEnv(deps, w.ID)
+	env := plugin.BuildWorkloadEnv(deps, w.ID, "static source")
 
 	containerPort := "80"
 	if mode == "deno" {
@@ -424,50 +424,6 @@ func deploy(ctx context.Context, deps plugin.Deps, w plugin.Workload, intent plu
 	return nil
 }
 
-// commitStatusReporter pushes deploy outcomes back to the git provider as
-// a commit status, gated on the per-workload report_commit_status flag.
-// It is strictly best-effort: every call is wrapped so a reporting failure
-// is logged at Warn and NEVER propagates to fail or block the deploy.
-//
-// The provider + identifiers are captured once at deploy start so the hot
-// transition points (pending/success/failure) read as one-liners. A nil
-// receiver (reporting disabled) makes report a no-op, so callers don't have
-// to guard each site.
-type commitStatusReporter struct {
-	provider  staticsite.GitProvider
-	owner     string
-	repo      string
-	sha       string
-	targetURL string
-	enabled   bool
-}
-
-// newCommitStatusReporter builds a reporter from the decoded config. When
-// report_commit_status is off (or the SHA is empty) the returned reporter's
-// report method is inert.
-func newCommitStatusReporter(provider staticsite.GitProvider, cfg Config, sha, targetURL string) *commitStatusReporter {
-	return &commitStatusReporter{
-		provider:  provider,
-		owner:     cfg.RepoOwner,
-		repo:      cfg.RepoName,
-		sha:       sha,
-		targetURL: targetURL,
-		enabled:   cfg.ReportCommitStatus,
-	}
-}
-
-// report sends one commit status, swallowing (and logging) any error. Safe
-// to call on a disabled reporter or with a nil provider/empty SHA.
-func (r *commitStatusReporter) report(ctx context.Context, w plugin.Workload, status staticsite.CommitStatus, description string) {
-	if r == nil || !r.enabled || r.provider == nil || r.sha == "" {
-		return
-	}
-	if err := r.provider.SetCommitStatus(ctx, r.owner, r.repo, r.sha, status, r.targetURL, description); err != nil {
-		slog.Warn("static site: commit-status report failed (ignored)",
-			"site", w.Name, "status", string(status), "error", err)
-	}
-}
-
 // statusTargetURL derives the https URL the commit status links back to —
 // the workload's primary public face, or "" when it has none.
 func statusTargetURL(domain string) string {