fix(pipeline): harden upstream resilience and production shutdown

DoH через DoWithRetry; CDN preview через UpstreamHTTPDo; частичный fail CDN (EVOBGP_CDN_PARTIAL_OK); безопасный доступ к Job.Meta; drain jobs при SIGTERM; ValidateProductionEnforce при EVOBGP_PRODUCTION=1.

Co-authored-by: Cursor <[email protected]>

internal/config/production.go

@@ -0,0 +1,38 @@
+package config
+
+import (
+	"fmt"
+	"os"
+	"strings"
+)
+
+// ProductionMode reports whether EVOBGP_PRODUCTION / EVOBGP_ENV=production is set.
+func ProductionMode() bool {
+	if v := strings.TrimSpace(os.Getenv("EVOBGP_PRODUCTION")); v == "1" || strings.EqualFold(v, "true") {
+		return true
+	}
+	env := strings.ToLower(strings.TrimSpace(os.Getenv("EVOBGP_ENV")))
+	return env == "production" || env == "prod"
+}
+
+// ValidateProductionEnforce enforces docs/production-checklist.md hard requirements
+// when ProductionMode() is true. Returns an error that should abort process start.
+func ValidateProductionEnforce() error {
+	if !ProductionMode() {
+		return nil
+	}
+	seedDemo := os.Getenv("EVOBGP_SEED_DEMO")
+	if seedDemo != "0" {
+		return fmt.Errorf("config: production requires EVOBGP_SEED_DEMO=0 (got %q)", seedDemo)
+	}
+	if strings.TrimSpace(os.Getenv("EVOBGP_DEV_INSECURE")) == "1" {
+		return fmt.Errorf("config: production forbids EVOBGP_DEV_INSECURE=1")
+	}
+	if strings.TrimSpace(os.Getenv("EVOBGP_BUNDLE_SEED_HEX")) == "" {
+		return fmt.Errorf("config: production requires EVOBGP_BUNDLE_SEED_HEX")
+	}
+	if strings.TrimSpace(os.Getenv("EVOBGP_CDN_ALLOW_PRIVATE")) == "1" {
+		return fmt.Errorf("config: production forbids EVOBGP_CDN_ALLOW_PRIVATE=1")
+	}
+	return nil
+}

internal/config/production_test.go

@@ -0,0 +1,31 @@
+package config
+
+import "testing"
+
+func TestValidateProductionEnforce(t *testing.T) {
+	t.Setenv("EVOBGP_PRODUCTION", "")
+	t.Setenv("EVOBGP_ENV", "")
+	if err := ValidateProductionEnforce(); err != nil {
+		t.Fatalf("non-production: %v", err)
+	}
+
+	t.Setenv("EVOBGP_PRODUCTION", "1")
+	t.Setenv("EVOBGP_SEED_DEMO", "1")
+	t.Setenv("EVOBGP_BUNDLE_SEED_HEX", "abcd")
+	t.Setenv("EVOBGP_DEV_INSECURE", "")
+	t.Setenv("EVOBGP_CDN_ALLOW_PRIVATE", "")
+	if err := ValidateProductionEnforce(); err == nil {
+		t.Fatal("expected error for SEED_DEMO!=0")
+	}
+
+	t.Setenv("EVOBGP_SEED_DEMO", "0")
+	t.Setenv("EVOBGP_BUNDLE_SEED_HEX", "")
+	if err := ValidateProductionEnforce(); err == nil {
+		t.Fatal("expected error for missing BUNDLE_SEED_HEX")
+	}
+
+	t.Setenv("EVOBGP_BUNDLE_SEED_HEX", "bd8fbcd31545aacfdd228203beca8e945ab9a752f2ce5624cf42d9f316389a9d")
+	if err := ValidateProductionEnforce(); err != nil {
+		t.Fatalf("valid production: %v", err)
+	}
+}