Mark Phase 2 done

First auto-instrumented sanctions trace verified in Tempo. Records what
carries forward: /healthz trace noise, the prod environment label in the
base compose file, and the red G10 guard test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docs/roadmap/phase-2.md

@@ -2,11 +2,27 @@
 
 *Part of `docs/roadmap/` — see [`intro.md`](intro.md) for platform/background context and [`summary.md`](summary.md) for how every phase fits together. Prev: [`phase-1.md`](phase-1.md) · Next: [`phase-3.md`](phase-3.md)*
 
-**Status:** In progress
+**Status:** Done
 
-**Message:** Started 2026-10-12. Step 1 (deploy the platform) is done and
-verified live, apart from reading the Alloy component graph. Next: step 2,
-zero-code auto-instrumentation of `sanctions`.
+**Message:** Started and finished 2026-10-12. The platform is deployed and the
+Alloy component graph has been read. `sanctions` runs under zero-code
+auto-instrumentation (`opentelemetry-distro==0.66b1` +
+`opentelemetry-exporter-otlp==1.45.1`, instrumentors installed by
+`opentelemetry-bootstrap` at build time). It exports traces only, over
+OTLP/HTTP to `https://otlp.vione.cloud`. First real trace:
+`9bfa05d03eabe3d3338a8672cf127465` (`POST /internal/lookup`), found with
+`{resource.service.name="sanctions" && kind=server && span.http.route!="/healthz"}`.
+
+Found along the way: Alloy returns **404** for OTLP metrics and logs. They are
+not silently accepted, and the docs were corrected to say so.
+
+Carried forward, all undecided:
+- **`/healthz` traces.** The Docker healthcheck produces a trace every 5s and
+  floods Tempo search. `OTEL_PYTHON_FASTAPI_EXCLUDED_URLS` would filter it.
+- **`deployment.environment.name=prod`** is set in the base
+  `docker-compose.yml`, so local runs would also be labelled `prod`.
+- **Guard test G10** (`test_dependency_files_do_not_list_observability_libraries`)
+  is red by choice until the guard suite is retired in Phase 3.
 
 **Time-box:** one evening.