feat(observability): correlate supervisor middleware decisions and changes #5394

User Story

I run request and response middleware in OpenShell sandboxes. I need to see which phase allowed, changed or rejected an HTTP operation and connect it to the original request.

Problem Statement

A request-level trace does not explain individual middleware phases, remote service calls or notable fail-open and capacity outcomes.

Impact / Why This Matters

Operators cannot reliably distinguish an API failure from middleware rejection or mutation, especially for streaming responses.

Proposed Design

Show only middleware phases that actually ran, under the inspected request. Propagate correlation context to remote middleware. Keep routine details in sampled spans and bounded notable outcomes in the existing primary security record, without exporting request or response content.

Suggested UX

In the trace viewer, expand an inspected request to see request/response middleware and remote RPC spans. The matching OCSF record retains the same request ID.

Acceptance Criteria

• Request and response phases and remote RPCs retain correct parentage, timings and outcomes.
• Mutation, denial, fail-open and capacity exhaustion are distinguishable without logging payloads.
• Absent bindings and streaming callbacks do not create phantom spans, duplicate routine records or unbounded diagnostics.

Alternatives Considered

Remote-service tracing alone cannot explain in-process middleware or OpenShell's chain behavior. Adding a separate unsampled audit record for every routine phase creates avoidable volume.

Agent Investigation

The local layer adds middleware phase and RPC instrumentation and bounded outcomes. Its public Rust result structs gain fields; external struct-literal compatibility needs review. No middleware protobuf field is added.

Component of #5210. This issue covers only middleware correlation; the tracking issue remains open for the other layers.

Checklist

• I've reviewed existing issues and the published docs.
• This is a design proposal, not a "please build this" request.