Enable Go thread context sharing across weblogs

[eliottness]

Motivation

Complete Go system-test coverage for the AppSec trace-ID pprof labels introduced by DataDog/dd-trace-go#5114.

This supersedes #7671 while preserving Daniel Mercier's endpoint implementation. The manifest boundary is corrected to v2.11.0-dev because the tracer change is present on release-v2.11.x; v2.12.0-dev would incorrectly skip the entire v2.11 release line.

Changes

• Move /security/thread_context_sharing into the shared Go common package.
• Register the shared handler in all nine tracer-backed Go application binaries. uds-echo reuses the Echo binary, covering ten weblog variants.
• Explicitly select the three GraphQL weblogs for THREAD_CONTEXT_SHARING without changing their existing category coverage.
• Enable Test_ThreadContextSharing globally for Go from v2.11.0-dev.

apim, envoy, and haproxy remain excluded because they are proxy-only topologies with build_mode: none and support only APPSEC_BLOCKING and DEFAULT.

Validation

• Built all nine Go application binaries against dd-trace-go main with the appsec build tag, including the nested orchestrion module.
• Ran go vet across the shared package and all nine binaries.
• Exercised all five HTTP dispatch shapes live: Datadog net/http mux, Chi, Echo, Gin, and orchestrion. Each returned the expected 128-bit decimal trace ID and span ID and wrote the canary.
• Verified the real scenario selector schedules ten Go weblogs in dev and nine in prod; the only prod omission is the pre-existing unreleased net-http-span-pool guard.
• Passed manifest validation, yamlfmt, yamllint, and the targeted CI-orchestrator metadata checks.
• No weblog unit tests were added; verification remains at build, live endpoint, and system-test layers.

The complete CWS/eBPF correlation still requires the privileged Linux CI scenario.

Reviewer checklist

• R&P approval for changes under utils/.
• No Docker base image modified.
• No scenario added, removed, or renamed.

Support: #apm-shared-testing

[github-actions]

CODEOWNERS have been resolved as:

utils/build/docker/golang/app/_shared/common/thread_context_sharing.go  @DataDog/system-tests-reviewers
manifests/golang.yml                                                    @DataDog/system-tests-reviewers
utils/build/docker/golang/app/chi/main.go                               @DataDog/system-tests-reviewers
utils/build/docker/golang/app/echo/main.go                              @DataDog/system-tests-reviewers
utils/build/docker/golang/app/gin/main.go                               @DataDog/system-tests-reviewers
utils/build/docker/golang/app/gqlgen/server.go                          @DataDog/system-tests-reviewers
utils/build/docker/golang/app/graph-gophers/main.go                     @DataDog/system-tests-reviewers
utils/build/docker/golang/app/graphql-go/main.go                        @DataDog/system-tests-reviewers
utils/build/docker/golang/app/net-http-orchestrion/main.go              @DataDog/system-tests-reviewers
utils/build/docker/golang/app/net-http-span-pool/main.go                @DataDog/system-tests-reviewers
utils/build/docker/golang/app/net-http/main.go                          @DataDog/system-tests-reviewers
utils/build/docker/golang/weblog_metadata.yml                           @DataDog/system-tests-reviewers

[datadog-datadog-prod-us1]

✅ All CI checks and tests passed.

🎉 All green!

🧪 All tests passed
❄️ No new flaky tests detected

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: 7041f30 | Docs | View more details | Give us feedback!}

[eliottness]

@danielmercier, could you review this follow-up to #7671? I kept your endpoint behavior, moved it into the shared Go package, enabled all tracer-backed Go weblogs, and corrected the activation boundary to v2.11.0-dev. Thanks!

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-14T13:07:08.838247Z	7041f30	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.