logctx: read commit_id from buildinfo.GitSHA (fix env-var divergence)

[mastermanas805]

Summary

• common/logctx/handler.go::commitID() previously read os.Getenv("COMMIT_ID") with a "dev" fallback. This was a decoupling shim from the days when logctx shipped before buildinfo.
• Both packages now live on the same instant.dev/common module. Today's B1 + B2 dispatches both surfaced the divergence: /healthz returned the real ldflag-patched buildinfo.GitSHA, but slog log lines emitted commit_id="dev" because COMMIT_ID env var is not set in k8s. The two systems disagreed on every running pod.
• Collapse to a direct intra-module import: commitID() now returns buildinfo.GitSHA. Same "dev" default (the buildinfo sentinel matches), so un-flagged local builds still emit commit_id="dev". Production binaries (Dockerfile builds with -ldflags -X) now have logs that agree with /healthz.

Changes

• logctx/handler.go — drop os import, add instant.dev/common/buildinfo import, commitID() returns buildinfo.GitSHA directly. Updated package doc explaining the wiring + historical note about the env-var shim.
• logctx/handler_test.go — new TestHandler_CommitIDFromBuildinfo that patches buildinfo.GitSHA (saved/restored via t.Cleanup), emits a record, and asserts commit_id reflects the patched value. Existing TestHandler_NoCtx still asserts default "dev" (sentinel unchanged).

No go.mod change — intra-module import.

Test plan

• go test ./logctx/... -v — 7/7 pass (6 originals + new TestHandler_CommitIDFromBuildinfo)
• go test ./... across the entire common module — buildinfo, crypto, logctx, plans all pass
• Downstream api builds clean against patched common; router + middleware tests pass (-count=1)
• Downstream worker builds clean
• Downstream provisioner builds clean
• After merge: rebuild instant-api Docker image, redeploy, confirm /healthz.commit_id matches a fresh log line's commit_id field on a real pod