observability(worker): add Cloudflare Sentry release and source maps

[JSONbored]

Part of #998. Related: #999, #1000, and #1001.

Context

The Cloudflare Worker/hosted path needs the same release/source-map discipline as REES and the self-host image: runtime release must match the exact uploaded bundle, stack traces should resolve to original source, and source maps should stay private release artifacts.

This issue is for Worker release/source-map hardening, not broad self-host Docker work.

Requirements

• Wire Cloudflare Worker Sentry release ids to the exact deployed bundle/commit.
• Upload Worker source maps from maintainer deploy workflows only.
• Confirm stack trace paths and Sentry code mapping requirements for the Worker bundle before documenting them.
• Ensure beforeSend privacy scrubbing from Sentry: privacy scrubber (beforeSend redaction) — non-negotiable #1000 is applied before any Worker event leaves the runtime.
• Keep DSN/config optional; unset Sentry config remains fully inert.
• Do not expose source maps through public assets or Worker routes.

Deliverables

• Worker build/deploy workflow changes for source-map upload and release association.
• Runtime release configuration for Worker Sentry events.
• Validation script or deploy check proving the release exists and maps were uploaded.
• Tests for release-id resolution and no-op behavior where practical.
• Documentation with exact code mapping/source-map troubleshooting values after verification.

Acceptance criteria

• A controlled Worker error in the deployed environment resolves from bundled Worker output to original repo source in Sentry.
• The Sentry release id on the event exactly matches the uploaded Worker artifact bundle.
• Source maps are private Sentry artifacts only.