Qualify credentialed HTTPS OpenTelemetry export after Praxis release #301

Summary

Follow up on #271 after Praxis releases the HTTPS OTLP/gRPC trust fix in praxis-proxy/praxis#1354. Grid should consume that release through its tracked gateway dependencies and prove that a credentialed collector receives spans over certificate-verified TLS.

#271 introduces opt-in gateway telemetry configuration. This issue tracks the secure collector-export capability that depends on the Praxis release; it is not a claim that successful exporter startup proves delivery.

Work

• Update Grid's Praxis dependencies and lockfile to a released version containing fix(otel): trust collector certificates for HTTPS OTLP/gRPC export praxis#1354.
• Build the gateway from the normal tracked manifest and lockfile, without a temporary dependency override.
• Verify the gateway accepts a trusted collector certificate, rejects an untrusted certificate and hostname mismatch, and never logs collector credentials.
• Run a collector-backed test that confirms spans actually arrive over HTTPS with Secret-backed OTLP headers and flush on normal shutdown.
• Update the OpenTelemetry guide and chart documentation to describe the supported trust source and the qualified image/version.
• Keep plaintext HTTP export limited to configurations without collector credentials.

Acceptance criteria

• A normal Grid gateway build exports spans to an HTTPS OTLP/gRPC collector using a configured trusted CA and Secret-backed headers.
• Negative CA and hostname tests fail certificate verification; no credential is sent to an untrusted or plaintext collector.
• The tested image identity and locked Praxis release are recorded with the qualification.
• Documentation matches the released behavior.

Cross-gateway span parentage remains tracked by #260 and praxis-proxy/praxis#1347. This issue is specifically about secure collector export.