feat(observability): link sampled supervisor request spans to workload traces #5471

User Story

I run OpenShell workloads with agent traces and protected API calls. I need to
connect a request to the supervisor stages that handled it without letting the
workload choose the supervisor's trace identity or sampling decision.

Scope Update

Following the corrected maintainer review, this work is being implemented
directly in #5214 with #5393's receipt/audit core:
#5214 (comment)

This issue no longer represents a separate implementation slice. #5362 remains
independent operator-sampling work, not a prerequisite for request tracing.
Broader correlation work remains tracked in #5210.

Proposed Design

• A supervisor-owned request span and children for stages that actually run.
• Valid sampled or unsampled workload traceparent as an explicitly untrusted
  link, never the supervisor parent. Ignore invalid/duplicate context and do not
  adopt workload tracestate.
• No additional denial-only spans on inspected paths.
• Enforcement, OCSF records and request-ID joins independent of sampling/export.
• HTTP tracing that ends before upgraded WebSocket sessions.

Do not record credentials, query values or payloads. The tracing helpers are
internal; no new configuration field, Relay dependency or mandatory sidecar.

Suggested UX

An instrumented client records x-openshell-request-id on its own trace.
Operators follow an untrusted link to a sampled supervisor trace or search OCSF
by the request ID without tracing. Links may appear as separate traces, not one
nested tree; full OCSF records do not return to the sandbox.

Acceptance Criteria

• Workload headers cannot control supervisor trace identity or parent-based
  sampling; valid workload context is only a link, never authorization.
• Actual request stages have correct parentage and timing; an HTTP upgrade
  does not make the request span last for the whole WebSocket session.
• Inspected middleware blocks and grant refusals create no denial-only span.
• Request-ID joins and feat(observability): join inspected HTTP receipts with OCSF records #5393's audit invariants hold without sampled spans,
  an exporter or an available collector.

Alternatives Considered

Request IDs alone remain useful but provide no stage timings. Workload parenting
conflicts with supervisor-owned correlation. This work does not implement
sampling configuration or supervisor metrics; those remain #5362 and #5364.

Agent Investigation

The current #5214 reintegration passed 1,660 network tests and 385 supporting
tests. Tests observe span creation separately from export, so unsampled traces
cannot hide denial-only span creation. Full pre-commit passed. Fresh native
Hermes/Relay workflows on b595d7060 produced 68 agent spans and 12 receipt/OCSF
joins to supervisor-owned traces. A separate trace-disabled live rerun retained
receipts and OCSF records without exporting supervisor request spans.

Checklist

• I've reviewed existing issues and the published docs.
• This is a design proposal, not a "please build this" request.