Replace X-Request-Id with the trace ID and retire the guard suite

Step 6: downstream_client() no longer sends X-Request-Id, and request_id
is gone from the internal request bodies, models, function signatures
and log lines; correlation now travels as traceparent. The gateway's
public request_id stays (the contract tests require it) but is now the
trace ID, 32 hex digits and still a valid UUID, so the value the
frontend shows can be pasted into Tempo.

Step 7: delete tests/test_no_observability.py. It guarded the Phase 0
"no observability" state, which Phase 3 ends by design.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

services/sanctions/app.py

@@ -30,7 +30,6 @@ SQLAlchemyInstrumentor().instrument(engines=[engine.sync_engine])
 
 class LookupRequest(BaseModel):
     holder_name: str
-    request_id: str = "unknown"
 
 
 @app.get("/")
@@ -61,15 +60,15 @@ async def readyz():
 
 @app.post("/internal/lookup")
 async def lookup(body: LookupRequest):
-    logger.info(f"lookup for holder_name={body.holder_name!r} request_id={body.request_id}")
+    logger.info(f"lookup for holder_name={body.holder_name!r}")
 
     if await chaos.sanctions_errors_enabled() and chaos.should_error():
-        logger.info(f"sanctions_errors chaos triggered for request_id={body.request_id}")
+        logger.info("sanctions_errors chaos triggered")
         return JSONResponse(status_code=503, content={"error": "sanctions vendor unavailable"})
 
     if await chaos.slow_sanctions_enabled():
         delay = chaos.sample_delay_seconds()
-        logger.info(f"slow_sanctions chaos sleeping {delay:.3f}s for request_id={body.request_id}")
+        logger.info(f"slow_sanctions chaos sleeping {delay:.3f}s")
         await asyncio.sleep(delay)
 
     # holder_name is PII: it stays off the span; only the outcome is recorded.