Honor canonical viewer plugin attribute 🤖🤖🤖 - #56

What does this PR do?

The Python tracing hooks already write the canonical nooa.viewer.plugin span
attribute, but the React trace viewer was still reading only the older
nemo_oo_agents.viewer.plugin key. That meant a registered viewer plugin could
not reliably opt into custom spans unless the span name happened to route to
the same renderer.

This PR makes the viewer prefer nooa.viewer.plugin, keeps the legacy key as a
compatibility fallback for imported pre-rename traces, and documents the
canonical metadata contract for future built-in renderers.

This is intentionally a small observability fix. It does not add a new plugin
registry mechanism or a security-specific viewer plugin; it makes the existing
registry seam work with the attribute the current NOOA tracer already emits.

Related issues

None.

Checklist

• Code follows the project style (uv run ruff check . and uv run ruff format --check . pass)
• Tests added/updated and passing (uv run pytest)
• Docs updated if behavior or public APIs changed
• New source files carry an SPDX license header (no new source files)

Validation

• npm ci --ignore-scripts && npm run build
• uv sync --all-extras --no-extra sandbox
• uv run pytest tests/tracing/test_viewer_plugin_attr.py -q
• uv run pytest -q -m "not integration and not stress"
• uv run ruff check .
• uv run ruff format --check .
• Bundled src/api/traces.ts with esbuild and verified canonical, legacy, and span-name fallback routing with a Node smoke test.