feat(claude-code): OTLP governance receiver + Loki store

[Shion1305]

What

Adds a Claude Code OTLP receiver for governance: an OpenTelemetry Collector
published on the internal Gateway at cc.i.shion1305.com, persisting Claude Code
telemetry to a new single-binary Loki store.

Claude Code ──OTLP/HTTP + Bearer──► cc.i.shion1305.com (internal Gateway, WireGuard-only)
                                       └► OTel Collector (bearertokenauth)
                                            ├─ logs    → Loki (90d, longhorn-hdd 100Gi)
                                            └─ metrics → Prometheus (ServiceMonitor)
                                                          Grafana ← Loki datasource

Changes

• apps/claude-code-app.yaml + claude-code/ — opentelemetry-collector chart
  (contrib image; core lacks bearertokenauth). OTLP/HTTP only (HTTPRoute is
  HTTP-only; gRPC would need a GRPCRoute). logs → Loki, metrics → Prometheus.
  HTTPRoute + ReferenceGrant on the internal Gateway, ESO SecretStore/ExternalSecret
  for the bearer token, ServiceMonitor, README.
• apps/loki-app.yaml + loki/values.yaml — Loki 7.0.0, SingleBinary,
  filesystem, 90-day retention on longhorn-hdd (100Gi).
• grafana/datasource-loki.yaml — cross-namespace Loki datasource (stable uid: loki).
• vault/scripts/setup-eso-policies.sh — eso-claude-code policy + role
  (dedicated claude-code/ KV mount).
• aqua.yaml — pin hashicorp/vault CLI to v2.0.0 (separate, unrelated change).

Networking

No custom NetworkPolicy required — the cluster-wide allow-from-infra policies
already permit Envoy Gateway → collector and Prometheus scrapes, and the Kyverno
cross-namespace isolation generator allows same-namespace collector ↔ Loki.

What it captures

Claude Code's OTel event stream (user_prompt, tool_result, tool_decision,
api_request, api_error) + metrics (token/cost/session/active-time). Not full
assistant responses. Prompt content only when the client sets OTEL_LOG_USER_PROMPTS=1.

Manual steps before it goes Healthy

1. Vault (policy/role land via the script; mount + token are out-of-band):

   vault secrets enable -path=claude-code kv-v2
   vault kv put claude-code/otlp token="$(openssl rand -hex 32)"

   The collector Pod stays pending until the claude-code-otlp-token Secret syncs.
2. Confirm cc.i.shion1305.com resolves to the internal Gateway (10.130.5.21;
   the *.i.shion1305.com wildcard + cert should cover it).

Validation

scripts/render-validate.sh passes for all apps including the new claude-code
and loki.