feat(go-services): tracker share_* handlers (complete ingest) + shadow tuning

- share.go: cross-machine vital sharing (share_subscribe/unsubscribe/share_*),
  faithful port of the peer-state snapshot + plugin fan-out + /vital-sharing/peers.
  The last ingest handler — the Go tracker now handles every plugin event type.
- shadow consumer: drop the outbound keepalive ping (the firehose is never idle)
  and tighten the read-deadline watchdog to 12s for faster reconnect after the
  upstream's periodic eviction (full-firehose browser clients get evicted ~every
  90s; the watchdog recovers it, ~90% duty cycle). Production-bound /ws/position
  is unaffected (plugins connect to us; no eviction).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

go-services/tracker-go/wsposition.go

@@ -69,6 +69,33 @@ func (p *pluginRegistry) send(name string, payload map[string]any) {
 	}
 }
 
+// fanoutShare forwards a share_* message to other opted-in plugin clients
+// (every connected name that is subscribed and isn't the origin). Send failures
+// are logged-and-ignored, not evicted (main.py:2829).
+func (p *pluginRegistry) fanoutShare(data map[string]any, origin string, subs map[string]bool) {
+	p.mu.RLock()
+	type target struct {
+		name string
+		c    *websocket.Conn
+	}
+	var targets []target
+	for n, c := range p.conns {
+		if n != origin && subs[n] {
+			targets = append(targets, target{n, c})
+		}
+	}
+	p.mu.RUnlock()
+	if len(targets) == 0 {
+		return
+	}
+	b, _ := json.Marshal(data)
+	for _, t := range targets {
+		ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+		_ = t.c.Write(ctx, websocket.MessageText, b)
+		cancel()
+	}
+}
+
 // pluginAuthOK constant-time-compares the supplied secret to SHARED_SECRET (and
 // the optional rotation fallback). Fails closed when unset or left at the
 // placeholder, matching main.py.