fix: launchWorkers cancelling other tenants' bundle workers

[yi-chen-roger]

Fixes #422

Changes

• Gather every tenant's bundles/sources/stacks first, then build one combined active-bundle set across all tenants before retiring any worker, instead of retiring against a single tenant's set while iterating tenants (which cancelled other tenants' still-valid workers as soon as a second tenant was onboarded).
• Stop clobbering s.failures on each tenant loop iteration so failures from earlier tenants aren't dropped.
• Extract collectTenantWorkloads and retireStaleWorkers out of launchWorkers so each step has a name.
• Add TestLaunchWorkers_MultiTenantDoesNotCancelOtherTenants, which reproduces the bug against the old code and passes with the fix.

Testing

• go test ./pkg/service/... — all pass (one pre-existing, unrelated TestService/config_with_builtins failure in this sandbox because httptest can't bind a local port here; reproduces identically on main without this change).
• go vet ./pkg/service/..., gofmt -l, golangci-lint run ./pkg/service/... — clean.

[yi-chen-roger]

@srenatus do you know who the Go Lint fails with message Error: The action 'Download dependencies' has timed out after 15 minutes.
how can I fix it in that case?

[srenatus]

I've rerun the lint test, it passed now.

Please have a look:

1. The new test hangs for 30s about half the time. pkg/service/launchworkers_test.go:105 waits for allWorkersDone(), but a worker only checks configurationChanged() at the top of Execute. If it finished its build before the test called UpdateConfig, the pool has it scheduled 30s out (worker.go:23), so the test blocks that long. 2 of 5 -count=5 runs took 30.02s. Adding .WithSingleShot(true) to the test's New() fixes it — workers die() after one iteration, and die() doesn't close changed, so the configurationChanged() assertion still holds. A bounded wait instead of the unbounded loop would also be nice.

2. failures is keyed by bare bundle name, not tenant_name. Now that the map spans all tenants (service.go:458, :509), two tenants with a same-named bundle collide. Same for s.report.Bundles[w.bundleConfig.Name] at service.go:298. Pre-existing and strictly less broken than before (the old code threw away all but the last tenant's failures), so fine as a follow-up issue rather than a blocker.

One behavior change worth being aware of: on a listing error the whole round is now skipped, so no tenant makes progress instead of the ones before the failure. In single-shot mode that means Run exits 0 with an empty report. It's the right call for the retire logic (partial activeBundles is exactly what caused the bug), just noting it.

[yi-chen-roger]

I've rerun the lint test, it passed now.

Please have a look:

1. The new test hangs for 30s about half the time. pkg/service/launchworkers_test.go:105 waits for allWorkersDone(), but a worker only checks configurationChanged() at the top of Execute. If it finished its build before the test called UpdateConfig, the pool has it scheduled 30s out (worker.go:23), so the test blocks that long. 2 of 5 -count=5 runs took 30.02s. Adding .WithSingleShot(true) to the test's New() fixes it — workers die() after one iteration, and die() doesn't close changed, so the configurationChanged() assertion still holds. A bounded wait instead of the unbounded loop would also be nice.
2. failures is keyed by bare bundle name, not tenant_name. Now that the map spans all tenants (service.go:458, :509), two tenants with a same-named bundle collide. Same for s.report.Bundles[w.bundleConfig.Name] at service.go:298. Pre-existing and strictly less broken than before (the old code threw away all but the last tenant's failures), so fine as a follow-up issue rather than a blocker.

1. Fixed — added .WithSingleShot(true) to the test's Service so a worker die()s right after its one iteration
2. Agreed this is pre-existing and not a regression from this change