feat(observability): relay OTLP metrics

[afourniernv]

Summary

Add opt-in OTLP metrics relay support to the OpenShell sandbox telemetry path.

This is the second signal-specific layer in the stack. It builds on the trace and logs layers without changing the default: sandbox telemetry relay remains disabled unless the gateway explicitly enables it.

Related Issue

Extends NVIDIA#2641 and NVIDIA#3196. This PR does not close either issue.

Changes

• advertise a versioned otel_export_metrics_v1 capability
• inject trace-specific and metrics-specific OTLP environment variables only for negotiated signals
• receive OTLP/HTTP protobuf metrics at /v1/metrics
• apply the existing admission, buffering, size, concurrency, and timeout controls
• remove workload-supplied trusted openshell.* metadata and attach gateway-owned resource attributes
• forward metrics through the supervisor session to the configured OTLP collector
• handle collector rejection and partial_success responses
• add gateway, Helm, protobuf, generated SDK, and user documentation updates

Testing

• cargo check -p openshell-server -p openshell-supervisor-process
• cargo test -q -p openshell-supervisor-process otlp
• cargo test -q -p openshell-server otel_relay
• focused capability and environment injection tests
• mise run helm:test
• mise run proto:lint
• mise run go:proto:check
• mise run pre-commit
• Hermes gateway health and NeMo Relay metrics exported through OpenShell /v1/metrics to an OTLP collector; independent signal negotiation and trusted metadata replacement verified

Checklist

• Changes are scoped to OTLP metrics relay support
• Sandbox telemetry remains explicitly opt-in
• Trusted OpenShell metadata cannot be supplied by the workload
• Tests and documentation are updated
• Commit is signed off for DCO

Stack

Draft stacked on #6 (codex/3196-stack-otlp-logs). Review this PR as the metrics-only delta from that branch.