fix(observability): honor OTLP configuration and suppress proxy spans

[rynfar]

Standard OTLP variables were ignored by the server and desktop, and browser trace uploads generated their own server spans. This ports the complete endpoint/exporter/trace-proxy group: each signal can select its endpoint, headers and HTTP protocol, or disable export with none; WSL receives those variables; trace uploads still authenticate, record locally and forward without adding server spans.

Pylon compatibility URLs retain precedence, and the global kill switch still wins. Invalid standard endpoint/header/protocol settings disable the claimed signal instead of falling through to another collector. Browser attributes use the existing truncation policy; decode warnings omit the raw body, while forwarded OTLP bodies remain intact.

Upstream accounting

Owning cycle: #865; frozen original bound ab099178a7b7f9728843e90fc95ed90bb61d710d. Complete source ports, including tests and operations docs:

• fd996d15e220144ac6e66670169aa87d074ce846 — standard endpoint, headers and protocol.
• 2598ce7a5ab0b25e32e0b67b084a9ec23cd8144f — desktop main process and WSL configuration.
• 74ee5153e05eb183dabec413ff9025d83d2058e4 — per-signal OTEL_*_EXPORTER=none.
• 294dd123410c77eead2810a052c31fb0cfd3e0c1 — renderer proxy suppression, attribute truncation and warning cleanup.

Attribution retained through cherry-pick -x. The server-layer conflict preserves Pylon MCP/CuaService and settings wiring. Adaptations keep Pylon warning text and compatibility identifiers, hoist the compiled protocol decoder, provide a typed outbound-client stub in Pylon's HTTP fixture, use its owned loopback server, and extend WSL assertions to exporter selectors and protocol.

Verification and limits

• 355 tests passed across shared OTLP/observability, server configuration/router, and desktop observability/backend configuration.
• The new proxy regression forwards both plain and query-string URLs, records zero proxy spans, and confirms another authenticated route still records http.server GET. Removing server trace suppression makes it fail with two http.server POST spans; restored code passes.
• Shared tests rerun after the decoder hoist; server/shared/desktop package typechecks passed. Scoped lint has no errors and no new warnings (existing server warnings remain); all 14 files pass format and diff checks.
• Existing desktop main-process metrics export remains disabled. Backend supports traces, metrics and logs. No browser/device or actual Windows/WSL runtime verification was performed.
• Existing WSLENV entries/flags are preserved. Operators must remove /p or /w flags that translate or block their OTLP values; documented rather than silently rewriting user configuration.
• Trace-proxy requests intentionally have no server span, including auth failures. Existing status codes/authentication remain covered by the router suite; those errors can carry traceId: unavailable.
• No release, install or migration changes. This is a pending port, not a claim that the full upstream audit is complete.

Model: GPT-6. Harness: Codex in Pylon.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	14.0 KiB	14.0 KiB	+5 B (+0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	7.3 KiB	7.3 KiB	−3 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.7 KiB	6.7 KiB	+8 B (+0.1%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	58.0 KiB	58.0 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	9	9	0 (0.0%)	21	✅
Claude	Total thread wire	13.9 KiB	14.0 KiB	+64 B (+0.4%)	15.1 KiB	✅
Claude	Thread snapshot wire	7.3 KiB	7.3 KiB	−2 B (−0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.7 KiB	6.8 KiB	+66 B (+1.0%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	58.8 KiB	58.9 KiB	+88 B (+0.1%)	66.4 KiB	✅
Claude	Live turn messages	8	10	+2 (+25.0%)	21	✅

Baseline: 2081f0b · PR result: 88263f6 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 115.7 KiB
• Claude decoded thread snapshot: 116.4 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[rynfar]

CI Check and all three server jobs passed. The non-server Test job failed only because the generated shell-cache equivalence test from #919 exceeded its default five-second timeout (5,731 ms under concurrent workspace testing). A separate test-only fix is prepared in #922; it retains 1,000 samples per schema and all equivalence assertions, setting a 20-second timeout for that test. No OTLP code change is indicated by this failure. #921 remains unapproved and must have green final-head checks before merge.