Slice 2/5: build(calm-hub): add observability and GitHub-backend dependencies

[jpgough-ms]

Description

• Extracted from feat(calmhub): OIDC + SCM (Git) backend support: #3001 — the second of 5 layered slices, see the tracking comment on feat(calmhub): OIDC + SCM (Git) backend support: #3001 for the full stack
• Targets main — Slice 1/5: feat(calm-hub-ui): loading states and link-based navigation #3061 (slice 1 of 5) merged, and GitHub retargeted this PR automatically
• Adds caffeine, jgit 7.2.0, quarkus-scheduler, and the OpenTelemetry/Micrometer stack as dependencies
• All additions are inert until a later slice wires a consumer — no runtime behaviour change
• OpenTelemetry is always compiled in (quarkus.otel.enabled=true) and disabled at runtime by default via the genuinely runtime-mutable quarkus.otel.sdk.disabled — set CALM_OTEL_DISABLED=false on the deployed container to turn it on, no rebuild required
• Commit authorship preserved: attributed to @byrash, committed by @jpgough-ms as part of this split

Review history

Went through 4 rounds of review-and-fix before being marked ready:

1. Comment claimed the test profile disabled both OTEL and Micrometer, but only OTEL was %test.-prefixed — Micrometer's core registry stayed active under mvn test
2. That same %test. prefix only applies when a test's profile name is literally test — this module has 4 other custom QuarkusTestProfile names, so Micrometer stayed active under mvn -P integration verify too
3. quarkus.otel.enabled is build-time-fixed — verified via javap against the Quarkus 3.34.7 jars and empirically (packaged one jar, ran it twice with only the env var changed: no toggle effect either way). The originally-documented CALM_OTEL_ENABLED=true production toggle silently never worked in a build-once-deploy-many pipeline. Fixed by switching to quarkus.otel.sdk.disabled, which is genuinely RUN_TIME-scoped — re-verified empirically that the same built jar now responds live to the env var. Micrometer has no equivalent runtime switch (confirmed via javap), so its binder toggles are honestly documented as build-time-only.
4. Clean — no findings

Type of Change

• 🔧 Chore (maintenance, dependencies, CI, etc.)

Affected Components

• CALM Hub (calm-hub/)
• Dependencies

Testing

• I have tested my changes locally
• All existing tests pass — full unit suite (2868 tests) and full Docker-backed integration suite (mvn -P integration verify, 540 tests), both 0 failures
• Empirically verified the runtime OTel toggle in both JVM mode (uber-jar) and GraalVM native compilation (Docker image against real MongoDB) — same jar/binary, only the env var changed between runs

Checklist

• My commits follow the conventional commit format
• I have added tests for my changes (if applicable) — n/a, no new application code
• My changes follow the project's coding standards

---

Split from #3001.

[jpgough-ms]

Native-compiled smoke test, run per request — confirming the runtime toggle actually holds under GraalVM native compilation, not just JVM mode:

• ../mvnw package -Dnative -Dquarkus.native.container-build=true — BUILD SUCCESS in 2:49, no reflection/JNI registration errors from the new deps (caffeine, jgit, quarkus-scheduler, opentelemetry, micrometer). 121.57MB binary.
• Built Dockerfile.native, ran the same image against a real MongoDB container twice, changing only the env var:
  • Default: zero OTel export activity
  • CALM_OTEL_DISABLED=false: live OTLP export attempts (connection-refused, since nothing was listening — proof the SDK was genuinely active)
• Confirmed the native binary actually serves traffic: GET /q/swagger-ui → 302, no-auth mode granting the request correctly, Installed features lists both opentelemetry and micrometer.

Same result as the JVM-mode verification in 33d6c9b — the fix holds under native compilation.