feat(observability): trace managed Session startup boundaries

[sam2tom]

Managed Session latency spans HTTP admission, background provisioning, Runtime discovery, Executor preparation and native startup. This adds reservation-derived trace correlation and bounded stage observations across Core, E2B helper/guest startup, Runtime transport and Codex initialization. Logs exclude request contents, credentials, catalog contents and raw SDK/native diagnostics.

Depends on #642 at a166c8223bacd9e65949b42718abf50d46f15820, which includes native E2B pause/resume, opaque retained-state ownership, direct capacity and zero-Turn idle suspension. That prerequisite is merged normally into this branch. Review the 43-file tracing increment as a166c8223bacd9e65949b42718abf50d46f15820..53e4e12c4234aa1c4a8ac93463c14235ef96ce60. This PR targets main, so the aggregate diff includes the prerequisite. Both branches preserve upstream main 601da24829386c03bd06b3557f3bd1afd09d33ee, including Runtime wire 0.16.0, schema 99 and native-session/workspace recovery.

Core links HTTP submission to durable reservation identity and carries traces on existing Runtime envelopes. Fixed observations cover preparation/control/first text and provider create/resume. Provider and guest timings use bounded stage allowlists, duration/output limits and request-owned correlation. The child-output buffer handles ReaderFrom so streaming cannot bypass its byte limit. Runtime/Codex observations preserve process exit, cancellation/join, pinned catalog validation and initialization deadlines.

The English and Chinese operations guide explains unavailable versus zero observations, nested/cumulative intervals, export-time timestamps, queue-clock skew and process-accounting limits. Guest/Runtime timing requires rebuilt, qualified templates; updating Core alone does not instrument existing sandboxes.

Validation after merging the current prerequisite and upstream main:

• Race tests passed for Codex, Runtime CLI/dispatch, E2B, runtimegateway and focused execution trace paths.
• 13 template and 279 pinned-SDK helper Python tests passed; translation hashes/structure and generated contract checks passed.
• Fresh independent review of the 43-file increment found no actionable P1/P2. Independent Go, Python and documentation checks are scoped to instrumentation; they do not replace real Provider qualification.
• The prerequisite's full dedicated PostgreSQL integration and native Linux CI passed, with subsequent targeted lifecycle tests. Two local host-history sampling tests also fail on the exact upstream 601da248 baseline and remain documented rather than treated as passing.

No live E2B allocation, model call or deployment was performed. These are controlled instrumentation checks, not measured cloud latency improvements or production acceptance.