feat(dev): collect local OTEL traces in project dev

[tejaskash]

Review this after #2043

This PR now contains exactly two things: the commits of #2039 (the OTLP trace storage layer it builds on) plus one commit of its own (~1,004 lines) — the part to review here. GitHub's stack tooling wouldn't let the base retarget, so until #2039 merges the diff shows both; after #2039 merges this collapses to just the collector work.

What this does (the ~1,004-line commit)

When you run agentcore project dev, your agent gets local tracing out of the box: an in-process OTLP/HTTP receiver starts on a loopback port, the agent's OpenTelemetry SDK is pointed at it via environment variables, and traces persist through #2039's TraceStore to agentcore/.cli/traces/. Nothing leaves the machine; --no-traces or instrumentation.enableOtel: false opts out.

• io/httpServer.ts — loopback-only node:http primitive (body caps, abort-signal close).
• otel/collector.ts — POST /v1/traces + /v1/logs, protobuf (pinned @opentelemetry/otlp-transformer@0.213.0 — the last version shipping request decoders; don't let dependabot bump it) or JSON.
• Handler wiring — collector lifecycle on the command's abort signal; signal-specific OTEL env vars so stray shell values can't redirect traces; host.docker.internal rewrite for containers; sitecustomize-on-PYTHONPATH so uvicorn --reload workers stay instrumented (a wrapper would only instrument the reloader parent).

Verification

Per-layer tests (receiver over real ephemeral-port HTTP with protobuf+JSON fixtures; handler with fake runners/collector; runner probe fakes) plus the end-to-end proof: built bundle → real project create (uv sync) → project dev → real Bedrock invocation → traces on disk. Protobuf decode verified under bun source, the Node bundle, and a compiled binary.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.13%. Comparing base (d72e3c9) to head (dd15e9e).

Additional details and impacted files

@@                    Coverage Diff                    @@
##           feat/dev-otel-storage    #1980      +/-   ##
=========================================================
+ Coverage                  97.11%   97.13%   +0.02%     
=========================================================
  Files                        385      387       +2     
  Lines                      22918    23117     +199     
=========================================================
+ Hits                       22256    22455     +199     
  Misses                       662      662              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Hweinstock]

based on description, it sounds like #2039 needs to land first so looking at that one now.

[tejaskash]

Review response, all four findings addressed in 84429afb:

• Unrelated reversions (cdk target guard, config-bundle TUI, error classification) — root-caused: the commit had been rebuilt as a whole-tree snapshot (reset --soft) taken from a branch last rebased onto an older refactor, silently reverting everything merged since. Rebuilt from explicit paths on the current base; the diff now contains only OTEL/dev files (verified: zero files outside io/, core/dev/, handlers/project/, router/, templates, deps).
• Linux Docker host-gateway — container runs now pass --add-host=host.docker.internal:host-gateway, so the OTLP endpoint rewrite resolves on Docker Engine; harmless on Desktop/Podman/Finch where the name already exists.
• 413 before close — oversized bodies now receive the 413 (with Connection: close) before the socket is destroyed; covered by a real 51 MiB request test asserting status 413 rather than a reset.