fix(pipeline): harden upstream resilience and production shutdown

DoH через DoWithRetry; CDN preview через UpstreamHTTPDo; частичный fail CDN (EVOBGP_CDN_PARTIAL_OK); безопасный доступ к Job.Meta; drain jobs при SIGTERM; ValidateProductionEnforce при EVOBGP_PRODUCTION=1.

Co-authored-by: Cursor <[email protected]>

internal/pipeline/collect_stale.go

@@ -20,6 +20,13 @@ func staleOnUpstreamError() bool {
 	return false
 }
 
+// cdnPartialOK reports whether a failed CDN source without stale cache should be skipped
+// instead of failing the whole module refresh. Opt-in: EVOBGP_CDN_PARTIAL_OK=1.
+func cdnPartialOK() bool {
+	v := strings.TrimSpace(os.Getenv("EVOBGP_CDN_PARTIAL_OK"))
+	return v == "1" || strings.EqualFold(v, "true")
+}
+
 func logStaleUpstream(kind, detail string) {
 	log.Printf("pipeline: stale upstream fallback (%s): %s", kind, detail)
 }