feat(supervisor): supervisor-direct OTLP trace relay, first iteration #4275

User Story

I run OpenShell sandboxes for OTel-instrumented agents and export the gateway's and supervisors' own spans to a collector (Tempo and MLflow behind an OpenTelemetry Collector). I need the agents' traces to reach that same collector, tagged with the sandbox they came from, without an egress exception per sandbox, so that I can see tool calls and LLM invocations next to the supervisor's network spans.

Description

Deliver the minimal end-to-end slice of #2641 that maintainers agreed on in #3196 (2026-10-05 and 2026-10-06), now that #3977 hands every supervisor the collector endpoint directly:

• Reserved relay address 192.0.0.8:4318, served inside the supervisor through a ReservedDestination proxy hook and hard-denied when no relay runs.
• OTLP/HTTP protobuf receiver on POST /v1/traces with fixed limits (body size, header and body timeouts, connection cap, per-request structural caps), google.rpc.Status error bodies.
• Bounded buffer and a single export task forwarding raw ExportTraceServiceRequests to OPENSHELL_OTLP_ENDPOINT over a lazily connected client that can later take a shared transport channel.
• Enrichment limited to openshell.sandbox.id and openshell.telemetry.source=agent, agent-supplied values for those keys removed.
• Relay active only when a collector endpoint is configured; bounded flush before the exit report; relay kept alive for exec sessions after the main process exits.
• OTEL_EXPORTER_OTLP_* (generic and traces-specific, compression disabled) injected into every workload process unless the creation request names its own OTLP endpoint, in which case the caller's values stand.
• Rejection and export-failure counts logged with a bounded cadence.
• Published docs and an e2e proving a span reaches a collector stub with attribution.

Context

• Part of feat(observability): agent-level trace collection via supervisor OTLP relay #2641 (umbrella design). This issue covers only the first PR; the umbrella stays open.
• Supersedes feat(observability): supervisor OTLP telemetry relay #3196, whose gateway hop, session protocol changes, and capability negotiation are unnecessary after feat(supervisor): export OTLP traces from sandbox supervisors #3977.
• Out of scope here and tracked on feat(observability): agent-level trace collection via supervisor OTLP relay #2641: separate agent and infrastructure collector lanes, TLS/authentication/compression on the relayed hop (to be built once as a shared transport in openshell-otel), batching and tunable limits, additional attribution attributes, JSON or gRPC receivers, OCSF event relay.

Definition of Done

• A span emitted inside a sandbox reaches the configured collector within 5 seconds with its original resource attributes plus openshell.sandbox.id and openshell.telemetry.source=agent, and agent-supplied values for those two keys are discarded.
• Without a configured collector, connections to the relay address are refused immediately and the supervisor logs the relay as inactive.
• Under a flood or an unreachable collector, memory stays within the documented bound, excess requests receive 503 with Retry-After, and the logs report counts without per-event lines.
• Buffered spans are flushed before the supervisor reports the main process exit, bounded by 5 seconds.
• A caller-set OTEL_EXPORTER_OTLP_ENDPOINT or OTEL_EXPORTER_OTLP_TRACES_ENDPOINT in the creation request is left untouched.
• Docs describe how to enable it, what the two attributes mean, and the client requirements (OTLP/HTTP protobuf, no compression).
• The e2e passes on at least one compute driver in CI.