refactor(worker): split worker.c into focused worker-private modules

[zeybek]

Summary

Split the monolithic src/worker.c (2367 lines) into six focused modules under src/worker/ and src/utils/, shrinking it to 525 lines (−78%). Behavior unchanged — six atomic, bisect-friendly commits.

Why

worker.c had grown to mix worker lifecycle, the batch dispatch pipeline, circuit breaker SPI, retry math, dispatcher connection pooling, and periodic maintenance — all in one translation unit. This goes against the Clean Architecture discipline the rest of the tree already follows (core/, queue/, dispatchers/, config/, utils/), makes unit tests nearly impossible, and slows navigation for contributors and AI agents alike. Goal: preserve behavior exactly while extracting single-responsibility modules with minimal public surface.

New modules

Module	Lines moved	Responsibility
src/utils/retry_policy.{h,c}	~128	Pure backoff math (unit-testable, no SPI)
src/worker/dispatcher_cache.{h,c}	~208	Per-worker dispatcher HTAB + MemoryContext + eviction + before_shmem_exit hook
src/worker/maintenance.{h,c}	~226	Lib init/cleanup, stale recovery, TTL expire, archive, DLQ cleanup
src/worker/batch_types.h	—	Shared MessageBatchInfo struct
src/worker/circuit_breaker.{h,c}	~65	cb_try_half_open_transition, cb_update_after_dispatch SPI wrappers
src/worker/batch_processor.{h,c}	~1199	Batch fetch (FOR UPDATE SKIP LOCKED), per-endpoint dispatch, status bookkeeping, DLQ archive, local stats flush

worker.c now contains

Entry points (ulak_worker_main, ulak_database_worker_main), signal handlers, the main loop, DSM param plumbing, and the startup stale-recovery call. 525 lines total.

Commits (bisect-friendly)

1. refactor(worker): extract retry policy helpers into utils/retry_policy
2. refactor(worker): extract dispatcher cache into src/worker/dispatcher_cache
3. refactor(worker): extract periodic maintenance into src/worker/maintenance
4. refactor(worker): extract MessageBatchInfo and circuit breaker SPI wrappers
5. refactor(worker): extract batch processor into src/worker/batch_processor
6. refactor(worker): trim unused includes from worker.c

Validation

Runs executed locally on PostgreSQL 18 inside the ulak-postgres Docker container, with all protocols enabled (ENABLE_KAFKA=1 ENABLE_MQTT=1 ENABLE_REDIS=1 ENABLE_AMQP=1 ENABLE_NATS=1):

• make installcheck — 27/27 regress passed on every commit
• make installcheck-isolation — 12/12 isolation passed on every commit (including circuit_breaker*, skip_locked, retry_visibility, dlq_concurrent_redrive)
• make installcheck-tap — 13/13 TAP passed (worker startup, SIGHUP reload, stale recovery)
• make format
• make lint
• make hooks-run

Not yet run locally — relying on CI

• ASan / UBSan build (-fsanitize=address,undefined) — CI runs this on all 5 PG versions
• cppcheck + clang-tidy --warnings-as-errors
• PG 14 / 15 / 16 / 17 matrix
• make test-e2e (non-HTTP protocol produce/flush paths)

The memory-context plumbing (batch context ownership transfer to batch_processor.c) is the highest-risk change; CI's sanitizer runs on the matrix are the belt-and-suspenders check.

Checklist

• Tests added or updated when behavior changed — no behavior change, existing coverage preserved
• Docs updated when user-facing behavior or operations changed — no user-facing surface affected
• Commit messages follow the repository convention
• This PR is ready for review