feat(tracing): show boundary connection time during sandbox startup - #5243

Summary

Startup traces currently charge backend connection and authentication waits to policy discovery. Add a boundary.connect child span so operators can see that wait separately.

Related Issue

Closes #5160.

Changes

• Trace the shared connection path for dial, backend-provided, runtime-initiated and routed transports.
• Record a fixed transport label and preserve the discovery parent. Cached channel reuse creates no extra connection span.
• Add two focused tests for authenticated waits, cached reuse, parent relationships, bounded fields, errors and cancellation.

Release Notes

Testing

• Checks appropriate to the affected code and behavior pass
• Unit tests added/updated (if applicable)
• E2E tests added/updated (if applicable)
• cargo test --locked -p openshell-sandbox-backend --lib connection_span_ -- --nocapture: both new tests passed in a fresh test build using real TLS/RPC transport fixtures.
• cargo clippy --locked -p openshell-sandbox-backend --all-targets -- -D warnings: passed on the final candidate.
• cargo fmt -p openshell-sandbox-backend -- --check and git diff --check: passed.

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)
• Architecture docs updated (if applicable)