test(coverage): worker internal/jobs 89.3% → ≥95%

[mastermanas805]

Summary

Closes the internal/jobs code-coverage gap. Measured by full-suite go test ./... (not a per-file -run filter, which overstates coverage), the package goes from 89.7% → 96.5%, clearing the ≥95% floor with margin. Seams, not waivers.

Coverage block

Metric	Before	After
internal/jobs aggregate (full-suite)	89.7%	96.5%

Per-file (the files this PR touches), aggregate statement coverage:

File	Before	After
k8s_namespace_client.go	0.0%	96.4%
custom_domain_reconcile.go	0.9%	94.8%
github_deploy_dispatcher.go	19.2%	93.3%
workers.go	21.7%	80.8%
deploy_status_reconcile.go	95.2%	96.2%
deploy_failure_autopsy.go	91.4%	96.4%

(Per-file numbers can sit below 95% while the package aggregate — the gate — is 96.5%; the residual per-file misses are live-S3 / live-k8s success returns and template-Execute-after-Must degraded arms.)

What changed

Source seams (no behaviour change)

• The four k8s client wrappers (k8sNamespaceClient, k8sPodStateClient, k8sDeployStatusClient, k8sAutopsyClient) had their cs field retyped from the concrete *kubernetes.Clientset to the kubernetes.Interface so fake.NewSimpleClientset can stand in. This is the exact follow-up the existing deploy_lifecycle_coverage_test.go note asked for. NewK8sAutopsyClient + new buildDeployStatusAndAutopsy take the interface too.
• custom_domain_reconcile.go: added a txtLookupFunc package-level seam so the TXT match/miss/error arms are hermetically testable.

New test files

• k8s_clients_fake_coverage_test.go — every namespace / pod-state / deploy-status / autopsy method against a fake clientset, including the apierrors.IsNotFound idempotency arms and the generic-error arms (fake reactor), plus the dual-failure-or-success constructors.
• github_deploy_dispatcher_work_coverage_test.go — Work / claimBatch / dispatch / postRedeploy / markFailed / markCompleted / permanentError.Error across happy path and every error branch (sqlmock + httptest + custom RoundTrippers).
• custom_domain_reconcile_coverage_test.go — all Work switch arms, every reconcileResult, all SQL helpers, TXT variants.
• workers_schedule_coverage_test.go — the three cron PeriodicSchedule.Next impls + scheduleFunc.Next, Workers.Started, entitlementRegraderAdapter, the StartWorkers bad-DSN guard, and a full River boot of StartWorkers (gated on a dedicated TEST_WORKER_STARTUP_DSN so it never perturbs the api-schema TEST_DATABASE_URL the propagation integration tests use) that covers the entire StartWorkers body + Workers.Stop's graceful-drain arm.

Verification

• go build ./... clean
• go vet ./... clean
• make gate green (the CI-equivalent -short gate; the new DB-driven test skips cleanly with no TEST_* env, exactly as CI runs)
• Full suite green under -race (no data races)

Functions still <95% (and why)

All residual are the un-seam-able tail: backup_s3.go / platform_db_backup_s3.go Upload/Download/Delete success returns (need a live S3/MinIO — error arms are covered), lifecycle_emails.go renderShell/renderBody/lifecycleText degraded fallbacks (unreachable after template.Must), real_prober.go live-probe success tails, and workers.go StartWorkers (80.8% — the optional-dependency if-set branches that only fire when Razorpay/MinIO/object-store env is wired). None drag the aggregate below 95%.

🤖 Generated with Claude Code