Rewrite every log call as an event name with typed fields

Prose f-strings become past-tense events with consistent field names
across services (account_id, transaction_id, amount_minor, risk_score,
status_code, consumer_group, message_id, chaos_flag). The orchestrator
and both consumers move from logging.getLogger to structlog so they can
pass fields.

New events cover what was silent before: the gateway's UpstreamFailure
path (transaction_failed, with the underlying cause), fraud's score and
sanctions' screening outcomes, and each successfully processed stream
message. holder_name is no longer logged at all.

"lookup" and "healthz" still appear in exactly one event each, so the
pathology tests' log-line counts are unchanged until they move to LogQL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/notifier/app.py

@@ -46,7 +46,7 @@ async def root():
 @app.get("/healthz")
 async def healthz(request: Request):
     if request.headers.get("X-Ledgerline-Probe") == "chatty-health":
-        logger.info("received chatty-health healthz probe from gateway")
+        logger.info("healthz_probe_received", probe="chatty-health")
     return {"status": "ok", "service": SERVICE_NAME}
 
 
@@ -60,6 +60,6 @@ async def readyz():
         span = trace.get_current_span()
         span.record_exception(exc)
         span.set_status(StatusCode.ERROR, str(exc))
-        logger.exception(f"readyz check failed: {exc}")
+        logger.exception("readyz_check_failed")
         return JSONResponse(status_code=503, content={"status": "unavailable"})
     return {"status": "ok"}

services/notifier/consumer.py

@@ -1,9 +1,9 @@
 import asyncio
-import logging
 import random
 import uuid
 
 import sqlalchemy as sa
+import structlog
 from opentelemetry import propagate, trace
 from opentelemetry.instrumentation.utils import suppress_instrumentation
 from opentelemetry.trace import SpanKind, StatusCode
@@ -14,7 +14,7 @@ from common.settings import settings
 
 from . import chaos
 
-logger = logging.getLogger("notifier")
+logger = structlog.get_logger("notifier")
 tracer = trace.get_tracer(__name__)
 
 GROUP = "notifier"
@@ -53,7 +53,7 @@ async def run():
     independent group (`audit`) reads the same stream in services/audit/worker.py.
     Redis Streams carry no automatic context propagation, deliberately."""
     await ensure_group()
-    logger.info("notifier consumer started")
+    logger.info("consumer_started", consumer_group=GROUP)
     while True:
         try:
             # The blocking poll would otherwise be a ~2s root trace every loop.
@@ -68,7 +68,7 @@ async def run():
         except asyncio.CancelledError:
             raise
         except Exception:
-            logger.exception("notifier consumer read failed")
+            logger.exception("stream_read_failed", consumer_group=GROUP)
             await asyncio.sleep(1)
             continue
 
@@ -92,8 +92,19 @@ async def run():
                 ) as span:
                     try:
                         await _handle(fields)
+                        logger.info(
+                            "stream_message_processed",
+                            consumer_group=GROUP,
+                            message_id=msg_id,
+                            transaction_id=fields.get("transaction_id"),
+                        )
                     except Exception as exc:
                         span.record_exception(exc)
                         span.set_status(StatusCode.ERROR, str(exc))
-                        logger.exception(f"notifier failed to process message {msg_id}")
+                        logger.exception(
+                            "stream_message_failed",
+                            consumer_group=GROUP,
+                            message_id=msg_id,
+                            transaction_id=fields.get("transaction_id"),
+                        )
                     await redis_client.xack(settings.stream_name, GROUP, msg_id)