fix: session env reads Layer-1 attrs from latest project_scan span

Addresses GPT consensus-review finding M2 on PR #938.

`annotateSession` was deriving `de.env.*` session attributes by regex-
parsing the `project_scan` tool's output text via
`detectEnvFromProjectScan()`. Two architectural problems:

1. Layer-1 violation: `project-scan.ts:935` already writes the
   authoritative `de.env.dbt_present`, `de.env.dbt_manifest_present`,
   `de.env.warehouse_type`, `de.env.tools_detected` onto the tool
   span's attributes (via the tracer's metadata-channel lift). The
   session rollup ignored that authoritative source and re-parsed the
   formatted output text, which is fragile to format drift and can
   disagree with the per-span Layer-1 values. This violated the PR's
   documented merge rule: Layer 1 (caller/tool-provided) wins over
   Layer 2 (derived).

2. Stale-state bug: used `find()` to pick the first project_scan span.
   A session that ran project_scan twice — e.g., scan, configure a
   new warehouse, scan again — reflected the first scan's state in
   the session root, not the latest.

Fix:

- Pick the LAST project_scan span in the toolSpans array (insertion
  order = wall-clock order, since spans are pushed in logToolCall).
- For each `de.env.*` key, read the span's Layer-1 attribute first.
  Fall back to the text-parse only when the Layer-1 value is absent.
- Text-parse fallback is computed lazily (only runs if at least one
  key needs the fallback) so the common case where all four keys hit
  Layer 1 skips the regex work entirely.

Verified with 3 cases: Layer-1 wins over conflicting text, text fallback
fills in absent attrs, latest of 2 scans wins.

Author: Haider

packages/opencode/src/altimate/observability/annotator.ts

@@ -501,14 +501,49 @@ export function annotateSession(trace: TraceFile): Record<string, unknown> {
     if (filesRead.size > 0) out[DE.ARTIFACTS.FILES_READ] = [...filesRead].slice(0, 100)
     if (filesEdited.size > 0) out[DE.ARTIFACTS.FILES_EDITED] = [...filesEdited].slice(0, 100)
 
-    // Environment capabilities (deterministic if project_scan ran — parse its output text)
-    const projectScanSpan = toolSpans.find((s) => s.name === "project_scan")
-    if (projectScanSpan) {
-      const env = detectEnvFromProjectScan(projectScanSpan)
-      if (env.dbtPresent != null) out[DE.ENV.DBT_PRESENT] = env.dbtPresent
-      if (env.manifestPresent != null) out[DE.ENV.DBT_MANIFEST_PRESENT] = env.manifestPresent
-      if (env.warehouseType) out[DE.ENV.WAREHOUSE_TYPE] = env.warehouseType
-      if (env.toolsDetected.length > 0) out[DE.ENV.TOOLS_DETECTED] = env.toolsDetected
+    // Environment capabilities. Prefer the project_scan tool's Layer-1
+    // `de.env.*` attributes (authoritative, set in project-scan.ts:935) over
+    // re-parsing its output text. Falls back to text parsing only when the
+    // Layer-1 attribute is absent.
+    //
+    // Picks the LATEST project_scan span (last one in the array — spans are
+    // pushed in insertion order in logToolCall) so that a session running
+    // project_scan twice (e.g., after adding a warehouse) reflects the
+    // current state, not the initial one. (GPT PR-938 consensus review M2.)
+    const projectScanSpans = toolSpans.filter((s) => s.name === "project_scan")
+    const latestScan = projectScanSpans[projectScanSpans.length - 1]
+    if (latestScan) {
+      const attrs = latestScan.attributes ?? {}
+      // Text-parse fallback computed lazily — only used per key when Layer-1
+      // is absent, so we still skip the regex work when all 4 keys hit Layer 1.
+      let fallback: ScanEnv | undefined
+      const parsed = (): ScanEnv => {
+        if (!fallback) fallback = detectEnvFromProjectScan(latestScan)
+        return fallback
+      }
+      const pickBool = (key: string, fb: () => boolean | undefined): boolean | undefined => {
+        const v = attrs[key]
+        if (typeof v === "boolean") return v
+        return fb()
+      }
+      const pickString = (key: string, fb: () => string | undefined): string | undefined => {
+        const v = attrs[key]
+        if (typeof v === "string" && v) return v
+        return fb()
+      }
+      const pickStringArray = (key: string, fb: () => string[]): string[] => {
+        const v = attrs[key]
+        if (Array.isArray(v) && v.every((x) => typeof x === "string")) return v as string[]
+        return fb()
+      }
+      const dbtPresent = pickBool(DE.ENV.DBT_PRESENT, () => parsed().dbtPresent)
+      const manifestPresent = pickBool(DE.ENV.DBT_MANIFEST_PRESENT, () => parsed().manifestPresent)
+      const warehouseType = pickString(DE.ENV.WAREHOUSE_TYPE, () => parsed().warehouseType)
+      const toolsDetected = pickStringArray(DE.ENV.TOOLS_DETECTED, () => parsed().toolsDetected)
+      if (dbtPresent !== undefined) out[DE.ENV.DBT_PRESENT] = dbtPresent
+      if (manifestPresent !== undefined) out[DE.ENV.DBT_MANIFEST_PRESENT] = manifestPresent
+      if (warehouseType) out[DE.ENV.WAREHOUSE_TYPE] = warehouseType
+      if (toolsDetected.length > 0) out[DE.ENV.TOOLS_DETECTED] = toolsDetected
     }
 
     // Outcome.executed: was a dbt-family DML command (build/run/test/seed/