feat(podman): export driver traces over OTLP (#2782)

Mirror the VM driver tracing setup for Podman. Export standalone driver
spans through OTLP/gRPC as the distinct openshell-driver-podman service,
propagate W3C context across ComputeDriver RPCs, record bounded RPC names
and failures, and flush buffered spans during graceful shutdown.

Podman still runs in-process when selected as a built-in gateway driver.
Add a temporary tracing shim that partitions gateway and Podman spans by
target into separate tracer providers while preserving their shared trace
and parentage. The shim also emits the same ComputeDriver server boundary
that the tonic layer emits out of process, keeping the observable trace
shape stable when Podman is eventually extracted.

Trace container create preparation, image and storage setup, lifecycle
operations, and cleanup. Document the service boundary and cover it with
isolated and repeated tracing tests.

Signed-off-by: Kris Hicks <khicks@nvidia.com>

Author: krishicks

Cargo.lock

@@ -16,6 +16,7 @@ path = "src/main.rs"
 
 [dependencies]
 openshell-core = { path = "../openshell-core", default-features = false, features = ["driver-extraction"] }
+openshell-otel = { path = "../openshell-otel" }
 
 tokio = { workspace = true }
 tonic = { workspace = true, features = ["transport"] }
@@ -32,11 +33,18 @@ nix = { workspace = true }
 rustix = { workspace = true }
 tracing = { workspace = true }
 tracing-subscriber = { workspace = true }
+tracing-opentelemetry = { workspace = true }
+opentelemetry = { workspace = true }
+opentelemetry_sdk = { workspace = true }
+tower-http = { workspace = true }
+http = { workspace = true }
 thiserror = { workspace = true }
 miette = { workspace = true }
 url = { workspace = true }
 
 [dev-dependencies]
+opentelemetry-proto = { version = "0.32", default-features = false, features = ["gen-tonic", "trace"] }
+opentelemetry_sdk = { workspace = true, features = ["testing"] }
 prost-types = { workspace = true }
 temp-env = "0.3"
 tokio = { workspace = true, features = ["test-util"] }

crates/openshell-driver-podman/Cargo.toml

@@ -7,6 +7,12 @@ driver runs in-process within the gateway server and delegates all sandbox
 isolation enforcement to the `openshell-sandbox` supervisor binary, which is
 sideloaded into each container via an OCI image volume mount.
 
+When the gateway configures `[openshell.gateway.otlp]`, Podman compute-driver
+spans export to the same OTLP/gRPC collector with the service name
+`openshell-driver-podman`. The driver preserves the gateway trace context and
+uses the same compute-driver RPC span names in its in-process and standalone
+forms.
+
 Before creating the container, the driver inspects the final sandbox image and
 captures its immutable image ID and raw OCI `Config.User`. Container creation
 uses that image ID with pulling disabled, preventing a mutable tag from changing