feat(proto): add SessionInjection + trigger_traceparent trace fields (RIG-2891)

docs/designs/DECISIONS.md

@@ -381,3 +381,9 @@ check enforces the mechanical half. Full rationale:
 | --- | --- | --- | --- |
 | DL-279 | The general dogfood e2e suite runs against ONE shared long-lived stack stood up once in the podman TestMain with `ExternalDatabase: true` over ONE suite-lifetime postgres (the RIG-2738 L2+L3 levers); legs isolate by per-leg account/channel namespace, and exactly four legs keep their own cold stack (`TestHarnessCore`, `TestLegSixTeardownIdempotence` (stack-restart), seed-settle, and the embedded-postgres smoke leg — note `TestLegFivePersistAndResume` MIGRATES). Composes with DL-257 (postgres-KEPT): the harness rides the first-class `--database-external`/`Config.DatabaseDSN` opt-out for speed, and the new smoke leg is the sole DEDICATED e2e coverage of the supervisor-owns-postgres lifecycle + pgid-record teardown | Active (Matt, 2026-08-27) | [test-harness tiers §Approach](platform/compass-test-harness-tiers/design.md#approach) |
 | DL-280 | The three test-harness tiers stay (unit stubs / pgtest / podman e2e — collapsing rejected; testcontainers-go wholesale rejected) and no fourth harness is grown: real-Postgres acquisition + per-test `search_path`-schema isolation converge on one shared `go/internal/pgshare` package underneath the tiers' existing doors — `pgtest.RequireDSN(t)` + `store.Open` stays the tier-2 entry point byte-for-byte (a consumer contract, e.g. RIG-2848), the podman TestMain reaches the same standup via `pgshare.StartSuitePostgresMain` — forge injection converges on the one production `hub.SetForgeCaller` seam, and all e2e lifecycle variants are `Fixture` functional options (`WithOwnStack`/`WithEmbeddedPostgres`) | Active (Matt, 2026-08-27) | [test-harness tiers §Consumers / boundary](platform/compass-test-harness-tiers/design.md#consumers--boundary) |
+
+## Observability & tracing
+
+| ID | Decision | Status | Record |
+| --- | --- | --- | --- |
+| DL-283 | The public `SessionInjection.traceparent` field (`compass.proto`, field 4) exposes the Server's active-span W3C `traceparent` on the SubscribeAgentSession observation surface, so a public subscriber can join a SessionInjection to the message's server-side trace (Matt ruled OQ2 = yes at the T4b freeze gate). Additive string scalar beside `from_handle` (a W3C trace-context token `00-<trace-id>-<span-id>-<flags>`, not an identifier); EMPTY when the Server had no active span; trace machinery never blocks or fails a delivery. The internal control-op (`agent.proto` SteerControl/DeliverControl) and causal-link (`agent_gateway.proto` CommsCallRequest.trigger_traceparent) legs are internal-tree, not a public-API decision | Active (Matt, 2026-08-27) | [server+runner OTel §T4](platform/compass-server-runner-otel/design.md#t4--trace-proto-fields-control-ops-public-observation-causal-link-stacked-seam) |