events: tell CertMagic which events are worth emitting - #8010

Follow-up to #7997 and caddyserver/certmagic#406, and the last piece of #7996.

Draft until CertMagic cuts a release. go.mod currently points at a pseudo-version of the merged commit; it needs to become a tag before this can merge.

Why

#7997 made dispatch cheap when nothing is subscribed, but it could not touch the data CertMagic had already built. GetCertificateWithContext emits tls_get_certificate as its first statement, and Go evaluates the argument before emit is entered, so the map and the ClientHello copy were assembled on every handshake regardless.

caddyserver/certmagic#406 added Config.ShouldEmitFunc for exactly this: an embedder answers whether an event is worth emitting, and CertMagic skips building the data when it is not.

Change

App.ShouldEmit becomes exported and is passed alongside OnEvent:

func (app *App) ShouldEmit(eventName string) bool {
	return app.subscriptions[eventName] != nil ||
		app.subscriptions[""] != nil ||
		app.logger.Core().Enabled(zapcore.DebugLevel)
}

The debug term matters. Emit writes a line for every event, so an event is observable whenever debug logging is on, even with nothing subscribed. A predicate that answered the literal "do I have subscribers?" question would silence that line — the trap @steadytao flagged when reviewing the CertMagic side. Emit's own shortcut now calls this method rather than repeating the condition, so the two cannot drift apart.

Benchmarks

CertLookupWithEventsApp is CertMagic's per-handshake certificate lookup, wired the way Caddy wires it. Not a full handshake — no TLS crypto, no I/O.

For the whole series, starting before #7997: 2045 → 540 ns/op, 5996 → 1824 B/op, 41 → 10 allocs/op.

ShouldEmit is covered for four states: nothing subscribed, a handler bound by name, a catch-all subscription, and debug logging on with nothing subscribed.

Assistance Disclosure

I investigated this with Claude Code (Claude Opus 5). It read the code paths, wrote the patch, the benchmarks and the tests, and ran the test suite. I directed the investigation, reviewed the change, and vetted it for correctness.