fix(pipeline): harden upstream resilience and production shutdown

DoH через DoWithRetry; CDN preview через UpstreamHTTPDo; частичный fail CDN (EVOBGP_CDN_PARTIAL_OK); безопасный доступ к Job.Meta; drain jobs при SIGTERM; ValidateProductionEnforce при EVOBGP_PRODUCTION=1.

Co-authored-by: Cursor <[email protected]>

internal/jobs/worker.go

@@ -291,8 +291,8 @@ func (w *Worker) runModuleRefresh(j *Job) {
 		}
 	}()
 
-	mid, _ := j.Meta["module_id"].(string)
-	if strings.TrimSpace(mid) == "" {
+	mid := strings.TrimSpace(j.metaString("module_id"))
+	if mid == "" {
 		j.Fail("missing module_id in job meta")
 		return
 	}
@@ -325,7 +325,7 @@ func (w *Worker) runTenantRefresh(j *Job) {
 		}
 	}()
 
-	moduleIDs := moduleIDsFromJobMeta(j.Meta)
+	moduleIDs := moduleIDsFromJobMeta(j.metaCopy())
 	if len(moduleIDs) == 0 {
 		j.Fail("missing module_ids in job meta")
 		return
@@ -449,8 +449,9 @@ func (w *Worker) enqueueDeployAllSpeakers(j *Job, tenantID, revID string) {
 }
 
 func (w *Worker) runDeployApply(j *Job) {
-	revID, _ := j.Meta["revision_id"].(string)
-	spk, hasSpeaker := j.Meta["speaker_id"].(string)
+	revID := strings.TrimSpace(j.metaString("revision_id"))
+	spk := strings.TrimSpace(j.metaString("speaker_id"))
+	hasSpeaker := spk != ""
 	if revID == "" {
 		j.Fail("missing revision_id in job meta")
 		return
@@ -571,7 +572,7 @@ func (w *Worker) runDeployApply(j *Job) {
 }
 
 func (w *Worker) runRollback(j *Job) {
-	src, _ := j.Meta["source_revision_id"].(string)
+	src := strings.TrimSpace(j.metaString("source_revision_id"))
 	if src == "" {
 		j.Fail("missing source_revision_id in job meta")
 		return