Otel for the agent

[pelikhan]

copilot added open telemetry support so we should proxy their env vars when set. Otel env vars are standardized.

[lpcox]

Research and implementation plan: #3179

Key findings:

• gh-aw already injects OTEL vars via workflow env + --env-all, so they reach the agent in that context
• Standalone AWF usage does NOT forward OTEL vars — this is the gap
• OTEL_EXPORTER_OTLP_HEADERS contains auth tokens but isn't one-shot protected
• OTLP/HTTP works through Squid; gRPC on port 4317 is blocked by default (appropriate)
• Recommended: auto-forward OTEL_* prefix + add header vars to one-shot token protection