feat(workspace): event_log module + EventLogConfig (#119 PR-2)

[HongmingWang-Rabbit]

Summary

PR-2 of the #119 hermes-style architecture series. Adds the workspace event log primitive — an append-and-query buffer that the canvas Activity tab and platform `/activity` endpoint will read in PR-3.

• `workspace/event_log.py` (new): `InMemoryEventLog` (bounded ring buffer, TTL + max_entries eviction, monotonic ids that survive eviction so cursors don't break, thread-safe under concurrent append) and `DisabledEventLog` (no-op for `backend: disabled`). Factory `create_event_log()` picks by name.
• `workspace/config.py`: nested `EventLogConfig` in `ObservabilityConfig` with backend / ttl_seconds / max_entries; lenient `_parse_event_log()` defaults a typo or out-of-band value rather than crashing boot.
• Schema-only — no consumers wired yet. Wiring lands in PR-3.

Why

Hermes ships a declarative observability block; molecule-core scattered the same knobs across env vars + hard-coded constants. Adopting the same shape pre-positions us for per-workspace tuning of cadence + retention without code changes, and gives platform-side fan-out a stable backend interface to swap (memory → redis) in a follow-up.

Eviction contract (load-bearing)

The workspace runtime is long-lived, so an unbounded list would leak. Every `append` prunes by both TTL (default 1h) and `max_entries` (default 10k). Reader cursors that fall behind past the eviction frontier see a contiguous tail without an error — the cursor protocol guarantees "events with id > since that are still resident", not "every event ever appended". A reader that needs at-least-once delivery polls faster than the eviction TTL.

Test plan

• 34 `test_event_log.py` tests — append basics, query+cursor, limit/since composition, FIFO + TTL eviction, clear, disabled backend, factory aliases (`disabled` / `off` / `none`), 8-thread × 200-append concurrency stress for unique monotonic ids
• 9 `test_config.py` tests — defaults / explicit override / partial override / unknown-backend fallback / non-positive bounds / non-dict block all coerce to documented defaults
• 100% line coverage on `event_log.py`; `config.py` new code 100% (uncovered lines are pre-existing idle_prompt path)
• Hermetic — TTL tests use injected clock, no `time.sleep`
• Run via `WORKSPACE_ID=test python3 -m pytest tests/ -k 'config or event_log'` → 135 passed

Stack

• PR-1 (fix(scheduler): #152 problem B — surface cron error_detail in schedule history #206) merged: schema for ObservabilityConfig.heartbeat_interval_seconds + log_level
• PR-2 (this): event_log module + EventLogConfig ← here
• PR-3 (feat(hermes): Phase 1 — multi-provider registry (15 providers, 26 tests, back-compat preserved) #208): wire observability config into heartbeat/main + canvas Activity tab
• PR-4 (fix(security): C2 from #169 — reject spoofed source_id in activity.Report #209): skill-compat audit + SKILL.md frontmatter docs

🤖 Generated with Claude Code

[github-actions]

🔒 Auto-merge disabled — new commit (9753d58) pushed after auto-merge was enabled. The merge queue locks SHAs at entry, so subsequent pushes can race. Verify the new commit and re-enable with gh pr merge --auto.