feat(workspace): wire observability heartbeat + log_level into consumers (#119 PR-3a)

[HongmingWang-Rabbit]

Summary

PR-3a of the #119 hermes-style architecture series. Wires the existing live consumers (heartbeat cadence + uvicorn log level) to read from `ObservabilityConfig` instead of hard-coded constants.

• `workspace/heartbeat.py`: `HeartbeatLoop` now accepts `interval_seconds=` keyword arg, defaults to the legacy `HEARTBEAT_INTERVAL=30` constant (backward compat for 2-arg callers / existing tests).
• `workspace/main.py`:
  • Constructs `HeartbeatLoop` with `config.observability.heartbeat_interval_seconds` (the parser-clamped [5, 300] value).
  • `uvicorn.Config` takes `log_level` from `config.observability.log_level` (lowercased — uvicorn's convention) with `LOG_LEVEL` env still winning as an ops debugging override.

Why

PR-1 (#206, schema-only) defined the fields with the comment "wiring lands in PR-3". This is that wiring. Operators can now tune cadence + verbosity per-workspace via `config.yaml` without a code change.

Scope

Adapter EventLog wiring (the third item in the original task #208 description) is deferred to PR-3b — touching `adapter_base` is a wider blast radius, needs careful design, and per code-review-and-quality skill the bias is toward smaller PRs. This PR is the safe + mechanical half.

Test plan

• `test_heartbeat.py`: 3 new tests pin default interval, explicit override, [5, 300] band acceptance without re-clamping
• All existing `test_heartbeat.py` + `test_config.py` tests pass (88/88)
• No behavior change when `config.yaml` omits `observability:` block — defaults match the previous hard-coded values
• `syntax` check on `main.py` + `heartbeat.py` pass

Stack

• PR-1 (fix(scheduler): #152 problem B — surface cron error_detail in schedule history #206) merged: schema for ObservabilityConfig
• PR-2 (fix(scheduler): #115 — skip cron fire when workspace busy #207, PR feat(workspace): event_log module + EventLogConfig (#119 PR-2) #2548) merged: event_log module + EventLogConfig
• PR-3a (this): wire heartbeat_interval_seconds + log_level into consumers ← here
• PR-3b: wire EventLog into adapter_base (deferred)
• PR-4 (fix(security): C2 from #169 — reject spoofed source_id in activity.Report #209): skill-compat audit + SKILL.md frontmatter docs

🤖 Generated with Claude Code