feat(cli): forward TRACEPARENT/TRACESTATE to gateway for CI trace continuity

[crm00re]

Summary

The CLI's gateway gRPC channel now passively forwards the W3C trace context (TRACEPARENT/TRACESTATE) from its environment, so a CI pipeline's trace parents the gateway's spans. This needs no OTel collector or provider on the CLI side - short-lived clients on CI runners and jump hosts just pass through what the CI system already exports.

Add EnvTraceContextInterceptor to openshell-otel: it reads the trace context once at construction and injects it as gRPC metadata, and is a no-op when the context is unset or invalid. Compose it with EdgeAuthInterceptor via a new GatewayInterceptor, since tonic allows only one interceptor per channel.

Related Issue

Closes issue #2639

Changes

• Add EnvTraceContextInterceptor to openshell-otel — reads TRACEPARENT/TRACESTATE from the environment and forwards them as gRPC metadata (no-op when unset or invalid)
• Compose it with EdgeAuthInterceptor in a new GatewayInterceptor on the CLI's gateway channel, so CI trace context now parents the gateway's spans
• Add unit tests for the valid, unset, and invalid cases
• Update architecture/gateway.md to document the passive CLI trace forwarding

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[crm00re]

I have read the DCO document and I hereby sign the DCO.

[johntmyers]

@krishicks this might be in your wheelhouse for a look

[github-actions]

This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity.

[crm00re]

I believe this bug fix is still ready for review and merge and should not be closed as stale. I've fixed the merge conflict which added a commit. If there's something else I can do to mark this "not stale" let me know! Thanks!

[github-actions]

This pull request has had no activity for 14 days and is now marked stale. It may be closed in 7 days if there is no further activity.

[rhuss]

Critical (build): This branch does not compile. The "Merge branch 'main' into fix2639" merge left duplicate pub use re-exports here, so cargo build -p openshell-otel fails with 9 E0252 errors (RecordGrpcFailure is re-exported three times at lines 10, 14, and 22; RecordGrpcStatus twice; HeaderMapExtractor/MetadataMapInjector/TraceContextInterceptor twice each). Since openshell-otel is foundational, the whole workspace is broken, so pre-commit cannot be passing on this HEAD.

Fix: drop the duplicated lines 10-15 and fold the new symbol into the existing canonical block at lines 26-28:

pub use propagation::{
    EnvTraceContextInterceptor, HeaderMapExtractor, MetadataMapInjector, TraceContextInterceptor,
    current_trace_context_carrier,
};

then re-confirm cargo build and cargo clippy (the duplicates also emit unused-import warnings).

The feature logic itself reads cleanly: EnvTraceContextInterceptor forwards TRACEPARENT/TRACESTATE as gRPC metadata and is a correct no-op when unset or invalid, with good test coverage. Just needs the merge fixed so it builds.

Source: cc-review correctness agent (build verified locally)