Split into 5-crate workspace for faster incremental builds

[strawgate]

Summary

• Split single-crate project into a Cargo workspace with 5 crates, isolating the heavy datafusion dependency in logfwd-transform so changes to other modules don't trigger its recompilation
• Updated Dockerfile to copy crates/ instead of src/

Workspace structure

crates/
  logfwd-config/      — YAML config parsing (serde, serde_yaml)
  logfwd-core/        — leaf modules: scanner, batch_builder, cri, compress, otlp, tail, input, diagnostics
  logfwd-transform/   — DataFusion SQL transform (the heavy dep, isolated)
  logfwd-output/      — output sinks (arrow, ureq)
  logfwd/             — binary: main.rs + pipeline_v2 orchestrator

Incremental build times

Change	Before (monolith)	After (workspace)
scanner.rs	~4s (full crate)	1.4s
otlp_sink.rs	~4s (full crate)	~1s
transform.rs	~4s (full crate)	~2s (only transform + binary)

Test plan

• cargo test --workspace — all 91 tests pass
• cargo clippy --workspace -- -D warnings — clean
• cargo fmt --check — clean
• No behavioral changes — pure structural refactor

🤖 Generated with Claude Code