fix(wallet-toolbox): keep storage traces off auth wire

[ty-everett]

Program and scope

• Tracker or issue: Wallet performance telemetry rollout for Metanet Client Desktop and Metanet Explorer Mobile
• Program gate(s) advanced: Wallet Toolbox telemetry compatibility and patch publication readiness
• Why this change is needed: Wallet Toolbox 2.4.20 added a standard traceparent request header to authenticated storage RPCs. AuthFetch intentionally accepts only content-type, authorization, and x-bsv-* headers, so the new header prevented wallet storage RPCs before transmission. This patch keeps trace/span correlation in the telemetry sink and sends no new RPC header.
• Explicitly out of scope: Any BRC-103/104 wire change; any SDK AuthFetch, Auth Express Middleware, AuthSocket, or AuthSocket Client behavior or source change; cross-process trace propagation.
• Exact head SHA reviewed: 0fb0ab7

Impact

• No public package source or manifest changed
• Public package source or manifest changed; affected packages are listed below
• Infrastructure source, dependency, image, or deployment configuration changed
• Public API, exports, types, runtime targets, or browser/mobile behavior changed
• Security-sensitive boundary changed
• Documentation or examples changed

Affected packages/services and intended patch versions (publication occurs only through the release workflow after approval):

• @bsv/wallet-toolbox 2.4.21
• @bsv/wallet-toolbox-client 2.4.21
• @bsv/wallet-toolbox-mobile 2.4.21

Verification

• Local commands and results: full workspace build passed; pnpm health:check passed (129); pnpm lint, format:check, typecheck, and audit:security passed; Wallet Toolbox format/lint/typecheck/build/coverage passed (179 suites, 1,541 tests, one governed pre-existing skip).
• Hosted CI run: https://github.com/bsv-blockchain/ts-stack/actions/runs/30685434071 passed on the exact head (32 successful, 7 expected scope skips).
• Conformance evidence: SDK AuthFetch additional/boundary 98/98; Auth Express Middleware 104/104; AuthSocket 41/41; AuthSocket Client 39/39.
• Coverage delta: Full Wallet Toolbox coverage gate passed.
• Lint/typecheck delta: Zero errors.
• Browser/mobile/packed-consumer evidence: Browser client 17/17 and platform contract passed; mobile 18/18 and Metro/Hermes contract passed; core, browser, and mobile pack checks passed.
• Performance or bundle-size delta: No runtime tracing work added; Vite raw/gzip/brotli 1,486,402/350,464/274,706; esbuild 1,162,198/318,620/257,235; Metro 1,557,192/392,375/306,121; Hermes 3,131,686/1,241,990/980,968.
• I self-reviewed the complete diff for correctness, security, compatibility, public API, artifacts, dependencies, docs, and operations
• All applicable checks are terminal and successful on the exact head; any scope-based skip is expected and validated by the merge gate

Security and dependencies

• No dependency or lockfile change
• Changelog, runtime relevance, peer compatibility, transitive graph, and audit results were reviewed
• CodeQL/negative tests cover any changed trust boundary
• The exact-head CodeQL analysis has no new alert
• The exact-head repository quality gate reports zero new Sonar findings (including accepted or false-positive issue states) and zero unreviewed hotspots; Sonar's aggregate Quality Gate passed verdict alone is not merge evidence
• No new override, advisory dismissal, quality suppression, or skipped test
• Any temporary exception is registered with owner, evidence, review date, and removal condition
• Workflow permissions and lifecycle-script behavior remain least privilege

Dependency evidence

• Release notes and necessity: No dependency change; package patch versions and release notes describe the AuthFetch-compatible telemetry fix.
• Runtime, build, and peer compatibility: Existing targets and peers unchanged; full browser/mobile/packed-consumer validation passed.
• Deduplicated lockfile: No lockfile change.
• Audit and CodeQL: Local security audit reports no vulnerabilities; hosted CodeQL pending.
• Package and consumer tests: Core, browser, mobile, SDK AuthFetch, Auth Express, AuthSocket, and AuthSocket Client suites passed.
• Bundle and performance impact: Header formatting and injection removed from storage clients; no new runtime dependency or work.
• Affected public package versions: @bsv/wallet-toolbox, @bsv/wallet-toolbox-client, and @bsv/wallet-toolbox-mobile 2.4.21.

Release and operations

• No npm publication was performed from a workstation or from this PR
• Required npm patch bumps are included or intentionally deferred by the controlling program
• Image/SBOM/provenance/deployment/rollback impact is documented
• Documentation, changelog, migration, and operational guidance are current

Completion evidence

• The linked tracker is updated only for work fully proved by merged code, passing checks, resolved alerts, measurements, or an approved exception
• Review conversations are resolved
• Documentation, changelog, migration notes, release notes, and operator guidance are current or concretely not applicable
• No pending, failed, stale, cancelled, or unexpectedly skipped check is being handed to another contributor as complete

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!