PostHog error tracking for the hosted ORB Worker path (raw $exception, no SDK in the bundle)

[JSONbored]

Part of epic #8286 (Phase 1 — Errors).

• Blocked by Provision a loopover-owned Posthog project for the hosted fleet #7875.

Current state

The hosted ORB Worker path attaches Sentry via middleware: src/api/routes.ts imports sentry from @sentry/hono/cloudflare and, only when running in a real Workers isolate (isCloudflareWorkerRuntime) with WORKER_SENTRY_DSN set, registers app.use(sentry(...)) (env vars WORKER_SENTRY_DSN/WORKER_SENTRY_ENVIRONMENT, documented in src/env.d.ts as deliberately separate from self-host's SENTRY_DSN to avoid cross-wiring).

Deliverables

• Replace the middleware with raw $exception capture over PostHog's capture HTTP API — no SDK in the Worker bundle (epic principle; posthog-node is documented as too heavy for Workers). Pattern: feat(observability): add PostHog error tracking via raw $exception capture metagraphed#7777 (src/usage-telemetry.ts raw-capture approach).
• Same runtime + env gating shape: no-op outside a Workers isolate or without the PostHog key env; WORKER_POSTHOG_* naming mirroring the existing WORKER_SENTRY_* split (and the same cross-wire warning ported to src/env.d.ts).
• Flush via waitUntil, mirroring the src/mcp/server.ts telemetry chokepoint's MCP tool-call telemetry fires without waitUntil, unlike this repo's own scheduleAfterResponse pattern #7233 approach (never block the response on telemetry).
• Redaction: reuse the scrub helpers from the self-host swap (or the typed-allowlist approach if the captured surface is small enough to enumerate).
• Sentry middleware stays in parallel until the decommission gate.
• Tests: capture fires on handler errors with redacted properties; no-op paths; bundle check stays green (no new Worker-bundle dependency).

Boundaries

• Only the Worker path — the self-host server swap is its own sub-issue.

Resources

• https://posthog.com/docs/libraries/cloudflare-workers
• feat(observability): add PostHog error tracking via raw $exception capture metagraphed#7777

[linear-code]

JSO-5731

[JSONbored]

Scope addition: sourcemaps

Same gap as noted on #8287: #8289 (discovery-index) and #8291 (loopover-ui) both explicitly scope a sourcemap pipeline; this issue doesn't, despite ORB being the highest-priority surface.

Adding as an explicit deliverable: the hosted ORB Worker bundle (src/index.ts via esbuild/wrangler) is almost certainly minified for production, so a raw $exception stack trace captured here will show bundled positions, not the original TypeScript source, unless a sourcemap is uploaded to PostHog as part of the release/deploy step. Needs the same PostHog sourcemap-upload mechanism #8289/#8291 use, wired into whatever CI step publishes this Worker.

[JSONbored]

Correction to the original scoping: this landed using posthog-node's own captureException(), not a hand-built raw $exception HTTP capture.

Checked PostHog's docs before implementing (per the epic's "avoid custom implementations, follow docs" principle):

• Their error-tracking docs explicitly warn against hand-constructing $exception events: "fails in the vast majority of cases because the exception event schema is strict and the SDK does not normalize or validate these properties when you use capture()."
• Their own Cloudflare Workers guide — the resource this issue itself linked — recommends installing posthog-node with flushAt: 1, flushInterval: 0 for the edge lifecycle, not a raw-HTTP fallback.

The "no SDK in the bundle" premise (mirroring metagraphed's usage-telemetry.ts) doesn't transfer cleanly here either: this Worker already bundles posthog-node for src/mcp/telemetry.ts's MCP usage events (#6235), so reusing it for error capture adds zero new bundle weight — unlike metagraphed, which has no PostHog SDK in its Worker at all today.

Implementation: src/api/worker-posthog.ts, an ephemeral-client-per-call design (mirroring src/mcp/telemetry.ts's identical choice for the identical edge-lifecycle reason), wired into src/api/routes.ts alongside the existing Sentry middleware via c.error (Hono's documented pattern — a plain try/catch around next() doesn't work here since Hono's own default errorHandler already converts the exception to a response several dispatch levels down before it would reach an outer middleware's catch). WORKER_POSTHOG_API_KEY/WORKER_POSTHOG_HOST/WORKER_POSTHOG_ENVIRONMENT env vars, separate from POSTHOG_API_KEY for the same cross-wire-avoidance reason WORKER_SENTRY_DSN is separate from self-host's SENTRY_DSN. Redaction reuses src/selfhost/redaction-scrub.ts's primitives (confirmed Workers-safe: the only Node-only import is dynamically loaded and unused unless an installation-id hash is actually requested).