observability: parameterize worker-status alert log group per env (CS-11107)

[lukemelia]

Summary

• The same provisioning/alerting/worker-status-group.json ships to both staging and production Grafana, but had the staging log group (ecs-boxel-worker-staging, account 680542703984) hardcoded into both Worker Reap and Worker Startup rules. Prod Grafana queries via the prod task role hit ResourceNotFoundException on every evaluation — once per minute × 3 retries × 2 rules — flooding the alert pipeline (and SMTP retries on top of that, tracked separately).
• Replace the hardcoded values with ${WORKER_LOG_GROUP_NAME} and ${WORKER_LOG_GROUP_ACCOUNT_ID}. apply-alerting.sh already supports ${VAR} substitution from the shell environment, and its header explicitly calls out log-group / account-id parameterization as the motivating use case.
• Per-env values are set in each apply workflow's job-level env: block (staging → ecs-boxel-worker-staging / 680542703984; production → ecs-boxel-worker-production / 120317779495). Hardcoded rather than SSM-sourced: the names follow the deterministic ecs-boxel-worker-<env> convention and the account-id is already implicit in AWS_ROLE_ARN.
• docker-compose.yml gets the same two vars with staging defaults so the local Grafana's file provisioning parses cleanly (local has no AWS creds, so the rule never actually evaluates).

Fixes CS-11107.

Test plan

• ./scripts/lint.sh clean (JSON parses, manifests valid, shellcheck clean)
• envsubst dry-run with staging values yields name=ecs-boxel-worker-staging, accountId=680542703984, correct ARN
• envsubst dry-run with production values yields name=ecs-boxel-worker-production, accountId=120317779495, correct ARN
• YAML env blocks parse cleanly (yq -e)
• shellcheck on apply.sh + apply-alerting.sh clean
• Stage-1 (merge): observability-apply-staging.yml runs against staging. Confirm both rules still evaluate cleanly there (they did before; this should be a no-op for staging).
• Stage-2 (manual dispatch from main): observability-apply-production.yml. Tail prod Grafana logs for ≥1h after apply and verify no ResourceNotFoundException for rule_uid=berxlrqsnzoxse or eerxlrqsghzwgd.

🤖 Generated with Claude Code

[github-actions]

Observability diff (vs staging)

No dashboard / folder changes detected against the staging Grafana.

(Run: https://github.com/cardstack/boxel/actions/runs/25763899826)

[github-actions]

Host Test Results

    1 files      1 suites   1h 43m 41s ⏱️
2 658 tests 2 643 ✅ 15 💤 0 ❌
2 677 runs  2 662 ✅ 15 💤 0 ❌

Results for commit af590ca.

Realm Server Test Results

    1 files      1 suites   11m 36s ⏱️
1 334 tests 1 334 ✅ 0 💤 0 ❌
1 413 runs  1 413 ✅ 0 💤 0 ❌

Results for commit af590ca.