Summary

• add a complete provider-neutral WorkloadIdentity covering workload, deployment, immutable revision, logical replica, provider unit, and node IDs
• validate identity values with a 128-byte ASCII bound and non-leaking errors
• add explicit fresh, stale, unavailable, and unknown observation metadata with sample and collection timing
• carry optional workload and observation fields through EnrichedEvent NDJSON
• extend IdentityResolver with a default None workload hook, preserving existing resolver implementations and legacy JSON shape

Scope boundary

This is the first independently reviewable contract slice of #8, not completion of the issue. The current collector is node-wide, so this PR deliberately does not apply one static environment identity to every event; doing so would misattribute multiple workloads on the same node.

Still open: per-replica Linux collection; CPU, memory, network, process, restart, and availability signals; rolling replacement and adoption fixtures; controlled OTLP and Prometheus metric exports; and cross-export parity evidence.

Validation

• cargo fmt --all -- --check
• cargo test -p a3s-observer -p a3s-observer-common
• cargo clippy -p a3s-observer -p a3s-observer-common -- -D warnings
• RUSTDOCFLAGS="-D warnings" cargo doc -p a3s-observer --no-deps

Progresses #8 without closing it.