Auto-instrument sanctions with OpenTelemetry zero-code

Add opentelemetry-distro/exporter-otlp (pinned pair) and run
opentelemetry-bootstrap at build time; wrap the sanctions command with
opentelemetry-instrument and configure the SDK via OTEL_* env (traces
only, OTLP/HTTP to otlp.vione.cloud). create-secrets.sh now writes the
base64 OTLP auth header into .env.observability.

The G10 guard test (no observability libraries in requirements) is
expected to fail from here until the guard suite is retired in Phase 3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

k8s/create-secrets.sh

@@ -10,7 +10,8 @@
 #                   (Prometheus, Alertmanager, Loki, Tempo, Alloy UI, OTLP)
 #   grafana-admin   Grafana admin user/password
 # and writes .env.observability at the repo root (gitignored) for the czy-side
-# Alloy log agent; copy it to the server once (see k8s/README.md).
+# Alloy log agent and the OTLP auth header of instrumented services; copy it to
+# the server after every regeneration (see k8s/README.md).
 #
 # KUBECTL defaults to `kubectl`; e.g. KUBECTL="ssh falken kubectl" to run it on
 # the node when the API server isn't reachable from here.
@@ -47,14 +48,19 @@ kubectl create secret generic grafana-admin -n "$NS" \
   --from-literal=admin-password="$GRAFANA_ADMIN_PASSWORD" \
   --dry-run=client -o yaml | $KUBECTL apply -f -
 
+# OTLP header for instrumented services: URL-encoded (space -> %20), and
+# newlines stripped because GNU base64 wraps at 76 chars and this is ~80.
+OTLP_BASIC=$(printf '%s:%s' "$OBS_USER" "$OBS_PASSWORD" | base64 | tr -d '\n')
+
 (
   umask 077
   cat > ../.env.observability <<EOF
-# Credentials for the Alloy log agent on czy (docker-compose.traefik.yml).
+# Credentials for the Alloy log agent and instrumented services on czy.
 # Generated by k8s/create-secrets.sh -- do not commit.
 LOKI_PUSH_URL=https://loki.vione.cloud/loki/api/v1/push
 LOKI_PUSH_USER=$OBS_USER
 LOKI_PUSH_PASSWORD=$OBS_PASSWORD
+OTEL_EXPORTER_OTLP_HEADERS=Authorization=Basic%20$OTLP_BASIC
 EOF
 )
 echo "wrote $(cd .. && pwd)/.env.observability"