feat(otel): emit server-side spans + traceresponse header (RIG-2889) - #713

* feat(otel): emit server-side spans + traceresponse header (RIG-2889)

Wire OTel emission into the compass-server binary and its RPC doors (T4b T2). The endpoint is env-only (`OTEL_EXPORTER_OTLP_ENDPOINT`); empty = tracing off, so the shipped socket-only path stays zero-overhead.

- **cmd/compass-server:** bootstrap `SetupTracerProvider`/`SetupMeterProvider` off `ServeConfig.OtelEndpoint` (populated from the env knob in `buildServeConfig`), defer both shutdowns before `Serve`.
- **serve.go / network_door.go:** mount `otelconnect` (outermost) + the trace-response interceptor on every door chain — socket + dev `CompassService`, `CommsService`, and the network shared bearer/admin-gate chain — so the RPC span envelopes the security interceptors and their ordering is unchanged relative to itself. Both interceptors are inert no-ops when no provider is installed. The interceptor + comms-handler construction lives in `buildDoors` (where `otelIC` is consumed), keeping `Serve` within its complexity budget.
- **comms.go:** stamp `compass.message.id` onto the handler span in `PostMessage` and `RespondToAsk` (no-op when no span is active).
- **CORS:** expose the `traceresponse` header on `devCORS` + `networkCORS` so a cross-origin browser can read the response trace id.

Adds `connectrpc.com/otelconnect v0.9.0`; refreshes the nix `vendorHash` for the moved module set.

Spec-impact: none. Refs RIG-2889.

Co-authored-by: Matt Wilkinson <matt@rigel.build>

* fix(otel): flush server providers on drain + real disabled-path assert (RIG-2889)

Review round 1 on PR #713.

### M1 — shutdown flush dropped on graceful drain

The deferred `traceShutdown`/`meterShutdown` ran with the signal-derived `ctx`, which is already cancelled by the time they fire (the SIGTERM that ends `Serve` is the same signal that cancels `ctx`). A cancelled ctx makes the SDK `Shutdown` abort its final `ForceFlush` immediately, so the last buffered batch of spans/metrics was silently dropped exactly on the drain path the defers exist to flush — contradicting the frozen design contract (bounded 2s shutdown flush, mirroring the agent).

Each defer now derives a fresh `context.WithTimeout(context.WithoutCancel(ctx), 2*time.Second)` at fire time (not at bootstrap, where an absolute deadline would expire mid-run), matching the `context.WithoutCancel` precedent already in `internal/runner/run.go`.

### L1 — vacuous disabled-path span assertion

`TestServerEmissionDisabledProducesNoSpansNoHeader` wired an in-memory exporter to a provider it never set global and never referenced, so its zero-spans check could never fire. Dropped the dead exporter; the traceresponse-header-absence assertion is the real disabled-path proof (no recording span ⇒ no header). Renamed to `TestServerEmissionDisabledSetsNoTraceResponseHeader` to match what it proves.

Spec-impact: none. Refs RIG-2889

Co-authored-by: Matt Wilkinson <matt@rigel.build>

* feat(otel): emit runner client spans (RIG-2890)

Wire OTel emission into the compass-runner binary and its outbound RunnerService client (T4b T3). Endpoint is env-only (`OTEL_EXPORTER_OTLP_ENDPOINT`); empty = tracing off.

- **cmd/compass-runner:** bootstrap `SetupTracerProvider`/`SetupMeterProvider` off `RunnerConfig.OtelEndpoint` (populated from the env knob via a `setupOtel` helper), defer the combined shutdown before `runner.Run`.
- **runner.go:** prepend the `otelconnect` client interceptor (outermost, ahead of the bearer-token interceptor) on `NewRunnerServiceClient` so enroll and Sessions dials emit CLIENT spans; a no-op when no global provider is installed.

Rides the `connectrpc.com/otelconnect v0.9.0` dep added by the T2 base commit (RIG-2889).

Spec-impact: none. Refs RIG-2890.

Co-authored-by: Matt Wilkinson <matt@rigel.build>

* fix(otel): drop dead RunnerConfig.OtelEndpoint + bound drain flush (RIG-2890)

Review round 1 on PR #714.

### M2 — dead, misleading `RunnerConfig.OtelEndpoint`

The field was write-only: `main.setupOtel` already installs and gates the global provider (that IS the enable gate), and `Dial` mounts the otelconnect interceptor unconditionally — no runner-package code ever read the field. Its doc comment nonetheless claimed it "gates whether this Runner exports OTel data", a false invariant for the next maintainer. Removed the field, the `OtelEndpoint:` set at the call site, and `setupOtel`'s now-unused endpoint return (it returns only the shutdown). The tautological `TestRunnerConfigOtelEndpointFromEnv` (asserted a struct field equals what it was just assigned — L2) is deleted; the enabled/disabled span tests already cover the real env → provider gate.

### M3 — shutdown flush dropped on graceful drain

`setupOtel`'s combined shutdown ran `tracerShutdown`/`meterShutdown` with the signal-derived `ctx`, already cancelled by the time the defer fires, so the SDK `Shutdown` aborted its final `ForceFlush` and dropped the last buffered batch — the same defect the sibling server bootstrap carried. The shutdown now derives a fresh `context.WithTimeout(context.WithoutCancel(ctx), 2*time.Second)` at fire time (not at bootstrap, where an absolute deadline would expire mid-run), matching the `context.WithoutCancel` precedent already in `internal/runner/run.go` and the frozen design's 2s bound.

Spec-impact: none. Refs RIG-2890

Co-authored-by: Matt Wilkinson <matt@rigel.build>

---------

Co-authored-by: Matt Wilkinson <matt@rigel.build>