feat(discovery-index): instrument with Sentry error tracking and release/sourcemap upload

[JSONbored]

Summary

• Reports route-handler errors and process-level unhandled rejections/exceptions from the discovery-index Cloudflare Container into the shared metagraphed Sentry project (jsonbored org) — the same project this repo's other hosted infra already flows into (part of Stand up centrally-owned observability for a hosted fleet #4934's centrally-owned observability initiative).
• Adds release and source-map tracking: upload-sourcemaps.ts runs as the first step of the container's runtime CMD (not baked into the Docker image, since SENTRY_AUTH_TOKEN is a runtime-only secret) — creates the release, associates commits, uploads/validates source maps, records the deploy, and finalizes, before deleting the uploaded .map files and starting the server. Mirrors review-enrichment/src/upload-sourcemaps.ts's design.
• Secret-named fields and GitHub-token-shaped values are redacted before any event leaves the process (src/sentry.ts).
• All new Sentry config (SENTRY_DSN, SENTRY_ORG, SENTRY_PROJECT, SENTRY_ENVIRONMENT) and the SENTRY_AUTH_TOKEN secret are optional — every piece no-ops cleanly with a log line when unset, never blocking the boot.

Scope

• The PR title follows type(scope): short summary Conventional Commit format.
• This PR is focused on discovery-index's Sentry instrumentation only.
• This follows CONTRIBUTING.md.
• Owner-authored infra PR (Cloudflare/Sentry account access is maintainer-only); not linked to a fresh open issue since it extends already-closed Stand up centrally-owned observability for a hosted fleet #4934.

Validation

• git diff --check
• npm run typecheck
• npm run test:coverage locally — sentry.ts and upload-sourcemaps.ts both at 100% line/branch coverage; full unsharded run: 1057 files / 20019 tests passing, no regressions.
• npm run build:mcp / npm run build:miner
• npm run cf:typecheck (Workers-runtime typecheck for worker.ts/rate-limiter.ts)
• npm audit --audit-level=moderate — pre-existing ambient advisories only (transitive via @modelcontextprotocol/sdk/agents, unrelated to this PR's @sentry/cli/@sentry/node additions); audit.yml documents this as a scheduled, non-blocking check, not a per-PR gate.
• Docker build + container boot smoke test: upload-sourcemaps correctly no-ops without real Sentry secrets, server starts, /health responds.
• wrangler deploy --dry-run confirms the new Sentry vars/bindings resolve correctly.
• New or changed behavior has unit tests for new branches, fallback paths, and redaction boundaries.

Safety

• No secrets, wallet details, hotkeys, coldkeys, user PATs, private keys, raw trust scores, or private rankings are exposed. SENTRY_DSN/SENTRY_ORG/SENTRY_PROJECT are non-sensitive (write-only ingest URL + slugs, safe as plain wrangler.jsonc vars); SENTRY_AUTH_TOKEN stays a wrangler secret, never committed.
• No visible UI changes.

Notes

Follow-up infra work on top of #7167/#4250 (discovery-index Cloudflare Container deployment). GitHub Actions build integration for automatic deploys is a separate, maintainer-side follow-up.

[superagent-security]

Superagent didn't find any vulnerabilities or security issues in this PR.

[codecov]

Bundle Report

Bundle size has no change ✅

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 91.79%. Comparing base (f27b9f0) to head (dc1c904).
⚠️ Report is 7 commits behind head on main.
✅ All tests successful. No failed tests found.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #7932      +/-   ##
==========================================
+ Coverage   91.77%   91.79%   +0.01%     
==========================================
  Files         731      733       +2     
  Lines       74878    75056     +178     
  Branches    22845    22902      +57     
==========================================
+ Hits        68717    68895     +178     
  Misses       5083     5083              
  Partials     1078     1078              

Flag	Coverage Δ
shard-1	57.64% <39.88%> (+2.36%)	⬆️
shard-2	53.09% <3.93%> (+1.08%)	⬆️
shard-3	49.50% <65.16%> (-4.62%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

Files with missing lines	Coverage Δ
packages/discovery-index/src/app.ts	100.00% <100.00%> (ø)
packages/discovery-index/src/sentry.ts	100.00% <100.00%> (ø)
packages/discovery-index/src/upload-sourcemaps.ts	100.00% <100.00%> (ø)