feat: shared observability kit - traces, logger, error capture

[vreshch]

Goal

Phase 0b of the observability plan (vault: features/observability): ONE reusable kit every agentage service adopts for traces + logs + errors, replacing the private web/packages/otel copy and catalog's hand-rolled otel-bootstrap.mjs.

What

• ./bootstrap - node --import preload, ported verbatim from web/packages/otel (ESM loader hook via module.register(), opt-in on OTEL_EXPORTER_OTLP_ENDPOINT + OTEL_SERVICE_NAME, fs/net/dns instrumentations disabled, bounded flush on SIGTERM/SIGINT).
• createLogger({service}) - NEW: pino preset, JSON to stdout only (no in-process shipping - the estate log agent tails containers), service on every line, trace_id/span_id injected from the active span = log<->trace correlation in SigNoz.
• captureError(log, err, ctx) - NEW: structured error log + recordException + ERROR span status in one call; safe without a tracer.
• Scaffold mirrors memory-core: strict ESM TS, eslint+prettier, vitest (14 tests), pr-validation + npm publish workflows, dependabot (UTC standard).

How I verified

• npm run verify green: type-check, lint, format, 14/14 tests, build, dist smoke.
• Runtime smoke: node --import ./dist/bootstrap.js with env set prints otel: tracing enabled, logger emits {"service":...,"msg":...} JSON, unreachable collector neither crashes nor hangs the process.
• Not yet verified against live SigNoz - that lands with the first adopter PR (web/catalog swap, Phase 0c).

Verify (for human)

• Review API surface (src/index.ts, README adoption checklist) - this is the contract all ~10 repos will pin.
• Publish happens only after a release commit or manual dispatch; needs NPM_TOKEN repo secret (same as memory-core).