resident P0+P1: DNS-level SSRF pin, batch budget, daily cap/cooldown/retention, PG schema/migration, dual-connection deadlock isolation, retarget baseline reset, proxy and structured failures, metrics

- DNS 级 SSRF pin：解析后 pin IP 建连，防 DNS 重绑定
- 批量总预算与每日上限/抖动冷却/保留期
- PG schema 与迁移清单
- 双连接死锁隔离
- 改目标重置基线
- 显式代理配置与结构化失败原因
- /metrics resident 口径

cloud/worker.py

@@ -6582,21 +6582,47 @@ class Worker:
             log_event(self.logger, "worker_push_due_failed",
                       message="push due processing failed: %s" % exc)
 
-    def process_due_resident_watches(self, now=None, fetcher=None):
+    def process_due_resident_watches(self, now=None, fetcher=None,
+                                     resolver=None):
         """常驻监听驱动（worker 轮次边界调用）：到期监听逐条
         走 resident.process_due_resident_watches，抢单 + 廉价
         抓取 + 仅变化建任务。全部异常只记日志，不炸循环；
         fetcher 缺省用 resident 默认抓取，单测可经
-        self.resident_fetcher 或参数注入假抓取。"""
+        self.resident_fetcher 或参数注入假抓取；resolver 同款
+        注入点（self.resident_resolver），生产路径为 None 即
+        默认 DNS 门，测试用它把测试主机名指到本地服务。
+        建表只在 worker 生命周期内做一次（首批）：热路径
+        不再逐条 ensure，见 resident.ensure 的调用约定；
+        批量内逐条隔离的异常与预算耗尽信号记
+        worker_resident_watch_failed 日志，不炸整批。"""
         if now is None:
             now = time.time()
         if fetcher is None:
             fetcher = getattr(self, "resident_fetcher", None)
+        if resolver is None:
+            resolver = getattr(self, "resident_resolver", None)
         try:
+            from cloud.resident import ensure_resident_tables as _ensure
             from cloud.resident import process_due_resident_watches as _run
             conn = _db_connect(self.db_path)
             try:
-                polls = _run(conn, fetcher=fetcher, now=now)
+                if not getattr(self, "_resident_tables_ensured", False):
+                    try:
+                        _ensure(conn)
+                        conn.commit()
+                        self._resident_tables_ensured = True
+                    except Exception as exc:
+                        log_event(
+                            self.logger, "worker_resident_watch_failed",
+                            message="resident ensure failed: %s" % exc)
+                errors = []
+                polls = _run(conn, fetcher=fetcher, now=now,
+                             resolver=resolver, errors=errors)
+                for watch_id, msg in errors:
+                    log_event(
+                        self.logger, "worker_resident_watch_failed",
+                        message="resident watch item failed: %s: %s"
+                                % (watch_id, msg))
             finally:
                 conn.close()
         except Exception as exc: