Post-1.0: OTLP tracing, broker image + compose service, install rehearsal

- tc-telemetry: fmt subscriber always; with [telemetry] otlp_endpoint
  set, spans batch-export over OTLP/HTTP. Tested against a REAL OTLP
  receiver decoding the actual protobuf (official proto types): the
  emitted span and service.name arrive on the wire. No endpoint = no
  export = no network (air-gap stance). tower-http TraceLayer gives
  every API request a span
- The broker finally has its own image (images/broker.Dockerfile,
  9.5MB from scratch) — the Helm chart referenced one that never
  existed — and the compose deployment now RUNS the broker, sharing a
  socket volume with the server (the unix-socket equivalent of the K8s
  sidecar). Compose secret flows were silently dead before this
- server.Dockerfile fixes surfaced by the rehearsal: the workspace
  build needs tools/ (bundler joined the workspace) and
  images/seccomp/ (include_str! profile) in the build context
- scripts/rehearse-install.sh (plan: clean-VM rehearsal): assembles a
  REAL signed bundle from the built images (server/frontend/broker/
  postgres/socket-proxy), runs the customer path — offline verify,
  docker load, compose up — and asserts /healthz plus the served login
  page before teardown. Passing locally; wired as a release.yml step,
  which also builds/ships the broker + socket-proxy images now

161 Rust tests + 29 journeys; clean-room rehearsal green.

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/bins/teamclaw-server/Cargo.toml

@@ -17,6 +17,7 @@ tc-db = { path = "../../tc-db" }
 tc-files = { path = "../../tc-files" }
 tc-llm = { path = "../../tc-llm" }
 tc-runtime = { path = "../../tc-runtime" }
+tc-telemetry = { path = "../../tc-telemetry" }
 tc-sandbox = { path = "../../tc-sandbox" }
 tc-scheduler = { path = "../../tc-scheduler" }
 tc-domain = { path = "../../tc-domain" }

crates/bins/teamclaw-server/src/main.rs

@@ -55,6 +55,9 @@ async fn run() -> Result<(), String> {
     let config_path =
         PathBuf::from(std::env::var("TEAMCLAW_CONFIG").unwrap_or_else(|_| "teamclaw.toml".into()));
     let config = AppConfig::load_from(&config_path).map_err(|e| e.to_string())?;
+    let _telemetry =
+        tc_telemetry::init("teamclaw-server", config.telemetry.otlp_endpoint.as_deref())
+            .map_err(|e| format!("telemetry: {e}"))?;
 
     let pool = tc_db::connect(&config.database.url, config.database.max_connections)
         .await