feat(observability): correlate supervisor middleware decisions and changes - #9

Summary

Connect request/response middleware phases and remote RPCs to the inspected HTTP
request while preserving the original middleware audit observations.

Related Issue

Closes NVIDIA#5394. Tracking: NVIDIA#5210.
Based on HTTP core #5214.

Changes

• Trace work where it actually runs, including streamed completion/cancellation
  and remote RPCs. Keep middleware denial distinct from transport and policy errors.
• Preserve invocation records independently of spans. Remove routine-record
  suppression and the obsolete private include_routine options; retain phase
  attribution, selected resource identities and the shared request UUID.
• Keep original request/response fields, bounded diagnostics and fail-open/closed
  findings without exporting payloads or credentials.
• Preserve current HTTP hooks, generation fencing and WebSocket session boundaries.

Release Notes

This draft changes direct Rust runtime-crate construction and exhaustive patterns:
ChainOutcome gains termination; HttpResponseInvocation gains transformed;
HttpResponseFinish and HttpResponseDiagnostics gain diagnostics_truncated;
HttpResponseMiddlewareFailure gains a private classifier and cannot be built
with an external struct literal. A constructor would not make old literals
compatible. Client SDKs, protobuf and middleware implementation trait signatures
are unchanged. Do not describe the entire layer as source-non-breaking.

Diagnostic limits still apply. After truncation, missing later mutation evidence
does not establish that nothing changed. Cancellation cleanup may outlive the
request without meaning the HTTP response remains in flight.

Testing

• Current carry: 2,138 affected-library tests passed; two existing network
  ignores. Strict normal pre-commit hook passed.
• Exact primary/companion partitions and preserved invocation fields with
  sampled, unsampled and no-exporter operation.
• Full mise run test passed on final integrated source 967d7d04, first run.
• Eight matching-source native Hermes/Relay cases, including request/response
  redaction, request blocking, upstream-200/client-403 withholding and no-host-trace
  export. Original invocation fields remain in OCSF independently of spans.

Checklist

• Existing PR/history and DCO sign-offs preserved; no force push.
• Compatibility scope distinguished from client SDK/protobuf compatibility.
• Maintainer acceptance and upstream promotion; remains draft.