refactor(source): dedup shared helpers across static + dockerfile plugins

Extract the verbatim-duplicated helpers into shared homes:
- buildEnv -> plugin.BuildWorkloadEnv (base plugin pkg; a sourceName param
  preserves each plugin's slog prefix / log-scraper text)
- idShort -> plugin.IDShort
- commitStatusReporter -> staticsite.CommitStatusReporter, re-parameterized
  on primitives (owner/repo/sha/targetURL/enabled) so staticsite needs no
  dependency on the plugin package; reporter tests ported to staticsite
  (plus a new nil-provider case)

containerNameFor/imageTagFor are intentionally left per-plugin: their
prefixes differ (dw-site- vs tf-build-) and name real Docker resources,
so merging them would risk mis-routing. Behavior-preserving; the
static/dockerfile test suites pass unchanged.

Reviewed: go APPROVE (0 CRITICAL/HIGH).

internal/workload/plugin/source/static/helpers_test.go

@@ -12,7 +12,7 @@ import (
 )
 
 func TestIdShort_TruncatesLongID(t *testing.T) {
-	got := idShort(plugin.Workload{ID: "abcd1234-5678-1234-abcd-deadbeef0000"})
+	got := plugin.IDShort(plugin.Workload{ID: "abcd1234-5678-1234-abcd-deadbeef0000"})
 	if got != "abcd1234" {
 		t.Fatalf("idShort = %q, want %q", got, "abcd1234")
 	}
@@ -20,14 +20,14 @@ func TestIdShort_TruncatesLongID(t *testing.T) {
 
 func TestIdShort_ShortIDPassesThrough(t *testing.T) {
 	// IDs shorter than 8 chars must not panic on slicing.
-	got := idShort(plugin.Workload{ID: "abc"})
+	got := plugin.IDShort(plugin.Workload{ID: "abc"})
 	if got != "abc" {
 		t.Fatalf("idShort = %q, want %q", got, "abc")
 	}
 }
 
 func TestIdShort_ExactlyEightChars(t *testing.T) {
-	got := idShort(plugin.Workload{ID: "12345678"})
+	got := plugin.IDShort(plugin.Workload{ID: "12345678"})
 	if got != "12345678" {
 		t.Fatalf("idShort = %q, want %q", got, "12345678")
 	}