Harden local telemetry export: routes, span logs, schema, manifest

[EhabY]

What

Hardening pass on the local telemetry export path, following the audit in #953 / #903.

Stacked on top of feat/issue-903-export-telemetry (PR #953) — please review/merge that first; this PR targets that branch, not main.

Changes

Audit point	Summary
#3 Route/cardinality guardrails	New normalizeRoute(): strips query+fragment, collapses UUID/integer segments to {id}, keeps curated templates, and buckets unknown routes to the first 3 segments + {*}. Applied to HTTP and websocket route telemetry.
#4 OTLP span-log routing	Span.log() / Span.logError() events export as OTLP log records linked to their parent span (traceId/spanId) instead of zero-duration spans. Timed spans (those with a framework result) still route to traces.
#9 Schema versioning	Per-row schema_version (CURRENT_TELEMETRY_SCHEMA_VERSION = 1), required in the Zod schema and stamped at emit time.
#6 / #7 Flush reporting	flush() returns a structured FlushStatus; the sink rejects on a write failure, so a failed pre-export flush surfaces a non-blocking warning that the export may be missing the latest events.
#8 OTLP manifest	OTLP zip includes manifest.json describing the export: format, telemetry + manifest schema versions, date range, source-file count, source-event count, and per-signal record counts.
#10 / #11 Cancellation + save destination	JSON writer accepts an AbortSignal (mirrors the OTLP writer); export rejects non-file save destinations with a clear error.
#5 OTLP provenance	Regression test: the OTLP resource describes the exporter while each record keeps its own producer context, so multi-session/historical exports aren't misattributed.

Deliberately not included (with rationale)

• #1 command activation — no-op. The ^1.105 engine auto-generates onCommand:* activation for contributed commands, so coder.exportTelemetry already activates from a cold session.
• #2 privacy confirmation modal — dropped. The export logs no path/contents, and the existing coder support bundle exports more-sensitive data with no modal.
• Manifest privacy flags — dropped. Inconsistent with coder support bundle (which redacts specific keys rather than flagging categories), low signal (deployment URL and machine id appear on nearly every event), and not a standard manifest concern.
• Manifest sink-health counters — dropped. They were session-cumulative and could not be scoped to the export's date range, so they implied an accuracy the export couldn't deliver. Flush and buffer-overflow failures are still logged, and a failed pre-export flush still warns.

Testing

pnpm test (1880 passing, 1 skipped), pnpm typecheck, pnpm lint, pnpm format:check all green. Unit tests cover route normalization, span-log routing, schema version, flush-failure surfacing, manifest contents, JSON cancellation, non-file save URIs, and OTLP provenance.

Closes #983.

---

🤖 Generated by Coder Agents.