Companion to the Cloudflare Workers + D1 schema + CreditAccount DO in
diggerhq/opencomputer-infra-internal. This is the Go half: Redis Streams
replacing NATS, HMAC-signed event forwarding to the CF events-ingest
Worker, HMAC-authed /admin/halt-org + /admin/resume-org endpoints called
by the CF CreditAccount DO, and a 60s halt_reconciler safety-net pull of
/internal/halt-list from the CF api-edge Worker.

Runs alongside existing PG billing unchanged (CF-parallel mode): the DO
mirrors orgs.free_credits_remaining_cents rather than replacing it, and
halt/resume dispatches are idempotent against the existing hibernate.

Highlights:
- Worker XADDs to events:{cell_id} stream every 2s; CP forwarder drains
  via XREADGROUP + XAUTOCLAIM, enriches each envelope with (org_id, plan)
  via PG lookup, and ships HMAC-signed batches to the CF ingest Worker.
- cfg.CellID (OPENSANDBOX_CELL_ID, defaults "dev-cell-a") is the new
  deployment identifier; cfg.Region retained for AWS/Azure/S3 duties.
  Renaming the two fully is deferred to the CF-authoritative cutover.
- usage_collector emits usage_tick events every 60s so CF can aggregate
  billing independently of PG.
- NATS fully removed: event_publisher, sync_consumer, controlplane/server.go
  (orphaned — no external callers), and nats.go deps gone.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>