Add OBS-006...008 for agent-reliability-otel-labels

[ericksondelacruz]

Summary

Adds three repo-scope rules that check whether an instrumented agent uses
agent-reliability-otel-labels
to label the spans it already emits. They form one ladder; each fires at the first
missing rung, so at most one fires per repo:

Rule	Fires when	Severity	Confidence
OBS-006	Tracing is initialized, but the library is neither declared nor imported	low	0.7
OBS-007	The library is installed, but no Run's mark_start is ever called	medium	0.65
OBS-008	A run is started, but mark_run_end is missing, or the repo has tools and no mark_tool_span call	medium	0.6

All three are gated on repo_observability_initialized: true, because the library
only labels spans that something else already creates.

schema_version 20 → 21.

Engine changes

• Recon: RepoProfile.OtelLabelsDeclaredIn records where the library is
  declared (agent-reliability-otel-labels / agent_reliability_otel_labels in the
  Python root manifests, @trustabl/agent-reliability-otel-labels in package.json).
  This is kept out of ObsDeps.
• Inventory: analysis.DiscoverOtelLabels emits typed OtelLabelsSignal records
  (import, run_start, tool_span, run_end, attr_literal) for Python and
  TypeScript/JavaScript. They are kept out of ObservabilitySignals, because the
  library never creates a span and must not satisfy its own prerequisite.
• Renamed imports are followed: each file's own imports are resolved, so
  mark_tool_span as mts and markToolSpan as label still count.
• Hand-written labels are credited: a repo that writes the trustabl.* keys
  itself, via set_attribute / setAttribute or a literal key of set_attributes /
  setAttributes, gets credit rung by rung:
  • any key → installed
  • trustabl.run_id → run started
  • trustabl.exit_reason → run end
  • trustabl.tool.input_fp / trustabl.tool.attempt → tool span
• Test files: every signal carries TestOrigin. Test-file signals still credit
  OBS-006..008, because a test importing the library is real evidence it is
  installed.
• Predicates: repo_otel_labels_installed, repo_otel_labels_initialized,
  repo_otel_labels_implemented.
• Chore: check-rules-sync.sh and the trustabl rules validate help text now
  point at agent-reliability-rules (the repo was renamed from trustabl-rules).

Not covered

• Whether the labels are correct: a shared Run, labels written only on the
  success path, a constant attempt, a run end recorded only on success. These are
  OBS-009..012, on a follow-up branch that waits for library 0.1.1.
• Hand-written keys that aren't string literals: a key held in a constant,
  passed as key=, or built from a template string is not credited.
• The Go binding: not inspected.

Depends on / merge order

Opened on top of #242 (feat/forge-runtime-tracing). Until #242 merges, this diff
also shows #242's commits.

1. Forge Runtime Tracing section for OpenTelemetry and Agent Reliability OTEL Labels #242 (forge Runtime Tracing)
2. trustabl-rulebook #__ (OBS-006..008 rationale)
3. agent-reliability-rules #__ (OBS-006..008 YAML). Merging this one releases the
   rules: scans pull the rules repo's main.
4. This PR, right after the rules PR. On main, the rules-sync job checks
   against the rules repo's main, so merging this first turns main red.

On this PR, rules-sync checks against the rules repo's branch of the same name
(feat/otel-labels-rules).

Older engines load the schema-21 pack leniently: they skip OBS-006..008 and report
a META-005 info finding.

Test plan

• go vet ./...
• go test ./...
• Every commit builds on its own
• RULES_REPO=../agent-reliability-rules scripts/check-rules-sync.sh (with the
  rules repo on feat/otel-labels-rules): in sync, 128 files, 333 rules
• CI green