Bootstrap tracing in code for sanctions, replacing the zero-code wrapper

common/telemetry.py builds the Resource, TracerProvider, BatchSpanProcessor
and OTLP/HTTP exporter by hand; sanctions calls setup_telemetry() at
import instead of running under opentelemetry-instrument. No instrumentor
is enabled yet, so sanctions emits no spans for now.

service.version comes from OTEL_RESOURCE_ATTRIBUTES: deploy.sh exports
DEPLOY_HASH (the server's HEAD after the pull) and compose falls back to
"dev". deployment.environment.name=prod is dropped.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker-compose.yml

@@ -7,6 +7,9 @@ x-app-env: &app-env
   SANCTIONS_URL: http://sanctions:8003
   INSIGHTS_URL: http://insights:8004
   NOTIFIER_URL: http://notifier:8005
+  # Merged into the Resource by Resource.create(). deploy.sh sets DEPLOY_HASH
+  # to the deployed git SHA; anything else (local runs) is "dev".
+  OTEL_RESOURCE_ATTRIBUTES: service.version=${DEPLOY_HASH:-dev}
 
 x-app-build: &app-build
   build:
@@ -140,7 +143,6 @@ services:
       <<: *app-env
       SERVICE_NAME: sanctions
       OTEL_SERVICE_NAME: sanctions
-      OTEL_RESOURCE_ATTRIBUTES: deployment.environment.name=prod
       OTEL_EXPORTER_OTLP_ENDPOINT: https://otlp.vione.cloud
       OTEL_EXPORTER_OTLP_PROTOCOL: http/protobuf
       OTEL_TRACES_EXPORTER: otlp
@@ -148,7 +150,7 @@ services:
       OTEL_LOGS_EXPORTER: none
     env_file:
       - .env.observability
-    command: opentelemetry-instrument uvicorn services.sanctions.app:app --host 0.0.0.0 --port 8003 --reload --no-access-log
+    command: uvicorn services.sanctions.app:app --host 0.0.0.0 --port 8003 --reload --no-access-log
     ports:
       - "8003:8003"
     healthcheck: