Post-1.0: OTLP tracing, broker image + compose service, install rehearsal

- tc-telemetry: fmt subscriber always; with [telemetry] otlp_endpoint
  set, spans batch-export over OTLP/HTTP. Tested against a REAL OTLP
  receiver decoding the actual protobuf (official proto types): the
  emitted span and service.name arrive on the wire. No endpoint = no
  export = no network (air-gap stance). tower-http TraceLayer gives
  every API request a span
- The broker finally has its own image (images/broker.Dockerfile,
  9.5MB from scratch) — the Helm chart referenced one that never
  existed — and the compose deployment now RUNS the broker, sharing a
  socket volume with the server (the unix-socket equivalent of the K8s
  sidecar). Compose secret flows were silently dead before this
- server.Dockerfile fixes surfaced by the rehearsal: the workspace
  build needs tools/ (bundler joined the workspace) and
  images/seccomp/ (include_str! profile) in the build context
- scripts/rehearse-install.sh (plan: clean-VM rehearsal): assembles a
  REAL signed bundle from the built images (server/frontend/broker/
  postgres/socket-proxy), runs the customer path — offline verify,
  docker load, compose up — and asserts /healthz plus the served login
  page before teardown. Passing locally; wired as a release.yml step,
  which also builds/ships the broker + socket-proxy images now

161 Rust tests + 29 journeys; clean-room rehearsal green.

Co-Authored-By: Claude Fable 5 <[email protected]>

crates/tc-api/Cargo.toml

@@ -24,6 +24,7 @@ tc-safety = { path = "../tc-safety" }
 tc-scheduler = { path = "../tc-scheduler" }
 tc-secrets = { path = "../tc-secrets" }
 thiserror = { workspace = true }
+tower-http = { version = "0.6", features = ["trace"] }
 time = { workspace = true }
 tokio = { workspace = true }
 urlencoding = "2"

crates/tc-api/src/lib.rs

@@ -123,5 +123,6 @@ pub fn router(state: AppState) -> Router {
         .route("/api/team/usage", get(routes::billing::usage))
         .route("/api/credits/redeem", post(routes::billing::redeem))
         .route("/api/team/permissions", get(routes::team::permissions))
+        .layer(tower_http::trace::TraceLayer::new_for_http())
         .with_state(state)
 }