[JeffLuoo]

ax-server cannot join a slow or failed command to the client that issued it, because the CLI sends no trace context. With --trace, an ax command starts a sampled root span, prints Trace ID: <id> to stderr, and sends a W3C traceparent on every AX RPC. ax-server (#557) and Substrate sample ParentBased, so they record the whole request.

• Without --trace, the CLI creates no tracer and sends no trace context, so ax-server's own sampler decides for CLI traffic, as with kubectl ate.
• RPCs are client spans under the command span, and resolving the ax-server address (which may start a port-forward) is a child span. CLI spans are exported over OTLP only when OTEL_EXPORTER_OTLP_ENDPOINT is set; OTEL_TRACES_EXPORTER and the resource follow ax-server: set up OpenTelemetry tracing, metrics, events, and JSON logs #557's rules.
• ax ssh returns the remote exit code instead of calling os.Exit, so the command span ends and the port-forward is cleaned up.

Pins otel v1.45.0 and otelgrpc v0.70.0, as #557 does. It does not depend on #557; the two overlap only in go.mod/go.sum. Server spans join these traces once ax-server adds the otelgrpc server handler.

Refs #13, #452.

Testing

• go test -race ./..., go vet ./..., and go mod tidy are clean. New tests in cmd/ax/trace_test.go cover the header with and without --trace, span parents, resource attributes, export and SDK warnings, streaming RPCs, the exporter rules, and exit codes.

[erain]

LGTM! Verified at 80cae1b: go build ./cmd/..., go vet ./..., gofmt, go mod tidy, and go test -race -count=3 ./cmd/ax/... all pass cleanly.

• Without --trace, activeTrace stays nil, creating no TracerProvider and sending no traceparent header so ax-server makes its own sampling decision.
• With --trace, startCommandTrace starts an AlwaysSample root span (ax <cmd>), prints Trace ID: <id> to stderr, wraps tunnel.EnsureServerURL in a resolve ax-server address child span, and configures otelgrpc.NewClientHandler with propagation.TraceContext{} only (no baggage) and metricnoop.NewMeterProvider().
• envSpanExporter and resolveExporters match #557's exporter and resource rules while only exporting CLI spans when an OTLP endpoint is set.
• Returning exitCodeError from runSSH cleanly runs defer cleanup() and flushes the command span before exiting with the remote exit code.