refactor(source): dedup shared helpers across static + dockerfile plugins

Extract the verbatim-duplicated helpers into shared homes:
- buildEnv -> plugin.BuildWorkloadEnv (base plugin pkg; a sourceName param
  preserves each plugin's slog prefix / log-scraper text)
- idShort -> plugin.IDShort
- commitStatusReporter -> staticsite.CommitStatusReporter, re-parameterized
  on primitives (owner/repo/sha/targetURL/enabled) so staticsite needs no
  dependency on the plugin package; reporter tests ported to staticsite
  (plus a new nil-provider case)

containerNameFor/imageTagFor are intentionally left per-plugin: their
prefixes differ (dw-site- vs tf-build-) and name real Docker resources,
so merging them would risk mis-routing. Behavior-preserving; the
static/dockerfile test suites pass unchanged.

Reviewed: go APPROVE (0 CRITICAL/HIGH).

internal/workload/plugin/source/static/naming.go

@@ -7,31 +7,18 @@ import (
 	"github.com/alexei/tinyforge/internal/workload/plugin"
 )
 
-// idShort returns the first 8 chars of a workload ID, used as the
-// uniqueness suffix on every Docker resource (container, image,
-// volume) the static source materializes. Workload names are not
-// UNIQUE in the schema today; including the ID short prevents two
-// workloads with the same name from clobbering each other's
-// container, image, or storage volume.
-func idShort(w plugin.Workload) string {
-	if len(w.ID) < 8 {
-		return w.ID
-	}
-	return w.ID[:8]
-}
-
 // containerNameFor is the deterministic container name. Includes
 // w.Name for visual continuity in `docker ps` plus the ID short for
 // uniqueness.
 func containerNameFor(w plugin.Workload) string {
-	return fmt.Sprintf("dw-site-%s-%s", w.Name, idShort(w))
+	return fmt.Sprintf("dw-site-%s-%s", w.Name, plugin.IDShort(w))
 }
 
 // imageTagFor is the deterministic image tag — same shape as the
 // container name so the linkage between an image and the workload
 // that owns it stays obvious from `docker images`.
 func imageTagFor(w plugin.Workload) string {
-	return fmt.Sprintf("dw-site-%s-%s:latest", w.Name, idShort(w))
+	return fmt.Sprintf("dw-site-%s-%s:latest", w.Name, plugin.IDShort(w))
 }
 
 // siteVolumeKey is the input to docker.SiteVolumeName / EnsureSiteVolume
@@ -41,7 +28,7 @@ func imageTagFor(w plugin.Workload) string {
 // envelope. Including idShort prevents two workloads sharing a name
 // from sharing one persistent volume.
 func siteVolumeKey(w plugin.Workload) string {
-	return fmt.Sprintf("%s-%s", w.Name, idShort(w))
+	return fmt.Sprintf("%s-%s", w.Name, plugin.IDShort(w))
 }
 
 // sanitizeError clamps an error string so persisting it (in