fix(pipeline): harden upstream resilience and production shutdown

DoH через DoWithRetry; CDN preview через UpstreamHTTPDo; частичный fail CDN (EVOBGP_CDN_PARTIAL_OK); безопасный доступ к Job.Meta; drain jobs при SIGTERM; ValidateProductionEnforce при EVOBGP_PRODUCTION=1.

Co-authored-by: Cursor <[email protected]>

internal/pipeline/collect_parallel.go

@@ -3,6 +3,7 @@ package pipeline
 import (
 	"context"
 	"fmt"
+	"log"
 	"net/http"
 	"os"
 	"strings"
@@ -218,12 +219,21 @@ func collectCDNPrefixRows(ctx context.Context, st store.Backend, hc *http.Client
 	wg.Wait()
 
 	var out []store.PrefixRow
+	var skipped int
 	for _, r := range results {
 		if r.err != nil {
+			if cdnPartialOK() {
+				log.Printf("pipeline: CDN partial skip source error: %v", r.err)
+				skipped++
+				continue
+			}
 			return nil, r.err
 		}
 		out = append(out, r.rows...)
 	}
+	if skipped > 0 && len(out) == 0 && len(valid) > 0 {
+		return nil, fmt.Errorf("cdn: all %d source(s) failed (partial ok)", len(valid))
+	}
 	if len(valid) > 0 {
 		if err := mergeAllCDNSourcesIntoModuleSnapshot(st, tenantID, mod, priorSnapshot, out); err != nil {
 			return nil, err