fix(worker): gate temporal activity diagnostics

[zebbern]

Summary

• route successful TraceActivity and secret resolver progress diagnostics through workflowDiagnosticLog
• keep warning/error console output unchanged
• add regression coverage that clears SENTRIS_DEBUG_WORKFLOW and verifies successful paths do not call console.log by default

Verification

• red tests first: affected tests failed on direct console.log calls
• bun test worker/src/temporal/activities/__tests__/trace.activity.test.ts worker/src/temporal/activities/__tests__/secret-resolver.test.ts
• bun test worker/src/temporal/activities
• git diff --check
• bun run lint
• bun run typecheck
• bun run test
• bunx tsc --build worker --force && bun run typecheck after full test cleanup
• git push -u origin codex/quiet-temporal-activity-diagnostics pre-push hook

[Copilot]

Pull request overview

This PR reduces noise in Temporal activity output by gating successful/progress diagnostics behind SENTRIS_DEBUG_WORKFLOW, while keeping warning/error logging unchanged. This aligns activity behavior with the existing workflowDiagnosticLog() helper so normal runs don’t emit console.log output unless explicitly enabled.

Changes:

• Route TraceActivity success diagnostics through workflowDiagnosticLog instead of console.log.
• Route secret resolver progress/success diagnostics through workflowDiagnosticLog while leaving console.warn paths untouched.
• Add regression tests that clear SENTRIS_DEBUG_WORKFLOW and assert successful paths do not call console.log by default.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
worker/src/temporal/activities/trace.activity.ts	Switch success logging from console.log to workflowDiagnosticLog for gated diagnostics.
worker/src/temporal/activities/secret-resolver.ts	Gate secret resolution progress/success logs via workflowDiagnosticLog; warnings remain direct console output.
worker/src/temporal/activities/tests/trace.activity.test.ts	Regression test ensures successful trace recording doesn’t call console.log when debug env var is unset.
worker/src/temporal/activities/tests/secret-resolver.test.ts	Regression tests ensure successful secret resolution doesn’t call console.log when debug env var is unset.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.