feat(cli): forward TRACEPARENT/TRACESTATE to gateway for CI trace continuity

[cmoore-redhat]

Summary

The CLI's gateway gRPC channel now passively forwards the W3C trace context (TRACEPARENT/TRACESTATE) from its environment, so a CI pipeline's trace parents the gateway's spans. This needs no OTel collector or provider on the CLI side - short-lived clients on CI runners and jump hosts just pass through what the CI system already exports.

Add EnvTraceContextInterceptor to openshell-otel: it reads the trace context once at construction and injects it as gRPC metadata, and is a no-op when the context is unset or invalid. Compose it with EdgeAuthInterceptor via a new GatewayInterceptor, since tonic allows only one interceptor per channel.

Related Issue

Closes issue #2639

Changes

• Add EnvTraceContextInterceptor to openshell-otel — reads TRACEPARENT/TRACESTATE from the environment and forwards them as gRPC metadata (no-op when unset or invalid)
• Compose it with EdgeAuthInterceptor in a new GatewayInterceptor on the CLI's gateway channel, so CI trace context now parents the gateway's spans
• Add unit tests for the valid, unset, and invalid cases
• Update architecture/gateway.md to document the passive CLI trace forwarding

Testing

• mise run pre-commit passes
• Unit tests added/updated
• E2E tests added/updated (if applicable)

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

All contributors have signed the DCO ✍️ ✅
_{Posted by the DCO Assistant Lite bot.}

[cmoore-redhat]

I have read the DCO document and I hereby sign the DCO.

[johntmyers]

@krishicks this might be in your wheelhouse for a look