github-ci Worker cannot reach the queue broker /events-append (tailnet-only) — public broker route needed for the #5693 sink design #6925

Gap found during the #5693 build (2026-11-07)

The #5693 design routes the github-ci Worker's push / pull_request / issues events through the queue broker: POST /events-append (the #5690 sink), so no third sink implementation exists.

The broker is unreachable from a Cloudflare Worker. The production queue broker listens on the tailnet only (100.99.113.103:4801 + UDS, per doc/fleet/queue-turso-cutover.md). It has no public route: the only Cloudflare Tunnel on the laptop (pm-tunnel) serves the pm stack, and the atlas-search tunnel pattern (a *.security.cab hostname + Access service token) has no broker equivalent.

What the Worker does until this lands

pkgs/github-ci/worker/src/sink.ts: when EVENTS_BROKER_URL is set, the Worker POSTs to {EVENTS_BROKER_URL}/events-append. Until then it performs the sink write itself — the exact INSERT INTO events statement the broker's verb_events_append executes (turso_queue.rs), same table (fleet-queue events), same row shape (worker_id github-webhook, task_id NULL, whole-second Z created_at). One sink, one table; the Worker is a client of the sink's semantics, not a third sink. Verified live 2026-11-07 (push + issues smoke events read back from fleet-queue events).

Acceptance

• A public, authenticated route to the queue broker exists (e.g. a queue-broker.security.cab tunnel hostname gated by a Cloudflare Access service token, following the atlas-search pattern in pkgs/atlas-search), OR an equivalent documented route.
• EVENTS_BROKER_URL (+ token, if the route needs one) is set on the github-ci Worker; a replayed push smoke lands its event row via the broker path.
• The direct-Turso fallback in sink.ts stays as the outage fallback, documented as such.

Refs #5693, #5690.

Acceptance criteria

• A public, authenticated route to the queue broker exists (e.g. a queue-broker tunnel hostname gated by a Cloudflare Access service token, following the atlas-search pattern), or an equivalent documented route.
• EVENTS_BROKER_URL (and the token, if the route needs one) is set on the github-ci Worker, and a replayed push smoke event lands via the broker path and is read back from the fleet-queue events table.
• The direct-Turso fallback in sink.ts remains in place and is documented as the outage fallback.