refactor(plugin): centralize workload conversion + container cleanup

Three packages (api, reconciler, webhook) each carried a private 30-line
toPluginWorkload() copy that had drifted — only the api version logged
malformed public_faces JSON; the others swallowed it. Hoist the single
implementation to plugin.WorkloadFromStore() (convert.go); store is
already a plugin dependency so no new import edge or cycle forms.

Likewise the dockerfile and static sources each had a private
removeContainerByName() that disagreed (remove-all vs stop-at-first).
Docker enforces unique container names, so the two were equivalent for
every reachable state; converge on plugin.RemoveContainerByName()
(container.go, stop-at-first) with a note on why remove-all was moot.

Callers migrated; old copies removed. Adds convert_test.go pinning the
field-by-field contract and JSON edge cases.

internal/reconciler/reconciler.go

@@ -15,7 +15,6 @@ package reconciler
 
 import (
 	"context"
-	"encoding/json"
 	"errors"
 	"fmt"
 	"log/slog"
@@ -169,7 +168,7 @@ func (r *Reconciler) reconcilePluginWorkloads(ctx context.Context, rows []store.
 		if w.SourceKind == "" {
 			continue
 		}
-		pw := toPluginWorkload(w)
+		pw := plugin.WorkloadFromStore(w)
 		if err := r.plugins.DispatchReconcile(ctx, pw); err != nil {
 			slog.Warn("reconciler: plugin reconcile failed",
 				"workload", w.ID, "kind", w.SourceKind, "error", err)
@@ -177,33 +176,6 @@ func (r *Reconciler) reconcilePluginWorkloads(ctx context.Context, rows []store.
 	}
 }
 
-// toPluginWorkload mirrors the api / webhook converters; kept local to
-// avoid an import dependency between those packages.
-func toPluginWorkload(w store.Workload) plugin.Workload {
-	var faces []plugin.PublicFace
-	if w.PublicFaces != "" {
-		_ = json.Unmarshal([]byte(w.PublicFaces), &faces)
-	}
-	return plugin.Workload{
-		ID:                      w.ID,
-		Name:                    w.Name,
-		GroupID:                 w.AppID,
-		ParentWorkloadID:        w.ParentWorkloadID,
-		SourceKind:              w.SourceKind,
-		SourceConfig:            json.RawMessage(w.SourceConfig),
-		TriggerKind:             w.TriggerKind,
-		TriggerConfig:           json.RawMessage(w.TriggerConfig),
-		PublicFaces:             faces,
-		NotificationURL:         w.NotificationURL,
-		NotificationSecret:      w.NotificationSecret,
-		WebhookSecret:           w.WebhookSecret,
-		WebhookSigningSecret:    w.WebhookSigningSecret,
-		WebhookRequireSignature: w.WebhookRequireSignature,
-		CreatedAt:               w.CreatedAt,
-		UpdatedAt:               w.UpdatedAt,
-	}
-}
-
 func (r *Reconciler) loop(ctx context.Context) {
 	defer r.wg.Done()