otel: add VM→host span relay for full container lifecycle tracing

Add a Traces.Stream ttrpc service that relays OTel spans from inside
the VM back to the host, mirroring the existing Events.Stream pattern.

VM-side:
- Channel-backed SpanExporter buffers spans (cap 1024, silent drop)
- TracerProvider with 100ms batch interval drains into the channel
- Traces ttrpc service streams spans to the host on demand
- Spans added to: task.Create/Start, runc.NewContainer, crun.create/
  start, ctrnetworking.Connect, mountutil.All

Host-side (shim):
- After VM boot, subscribes to Traces.Stream
- Converts proto spans to ReadOnlySpan via tracetest.SpanStub.Snapshot
- Corrects VM-vs-host clock skew (RTC has only second-level resolution)
  using host boot time as sync point
- Re-exports via OTLP HTTP with service.name=nerdbox-vm
- Spans added to: shim.BundleLoad, shim.VMBoot, shim.BundleTransfer,
  shim.IOSetup, shim.TaskCreate, shim.Start

The relay logic lives in internal/tracing so it can be reused by
integration tests without duplication.

Integration test extended to exercise Task.Create and Task.Start,
producing a 24-span trace visible in Jaeger.

Sample trace from TestTraceVMBoot (24 spans, ~80ms total):

  nerdbox     VM.NewInstance+Start........................  75.3ms
  nerdbox     . libkrun.VMStart...........................  72.4ms
  nerdbox     . libkrun.WaitForTTRPC......................  72.4ms
  nerdbox     . TTRPC.System.Info.........................   0.2ms
  nerdbox     . . System/Info (interceptor)...............   0.2ms
  nerdbox     . TTRPC.Bundle.Create.......................   0.2ms
  nerdbox     . . Bundle/Create (interceptor).............   0.2ms
  nerdbox     . TTRPC.Task.Create.........................   1.9ms
  nerdbox     . . Task/Create (interceptor)...............   1.8ms
  nerdbox-vm  . . . task.Create...........................   1.7ms
  nerdbox-vm  . . . . runc.NewContainer...................   1.5ms
  nerdbox-vm  . . . . . mountutil.All.....................   0.0ms
  nerdbox-vm  . . . . . crun.create.......................   1.5ms
  nerdbox-vm  . . . . ctrnetworking.Connect...............   0.0ms
  nerdbox     . TTRPC.Task.Start..........................   1.3ms
  nerdbox     . . Task/Start (interceptor)................   1.3ms
  nerdbox-vm  . . . task.Start............................   1.2ms
  nerdbox-vm  . . . . waitForCtrNetConnect................   0.0ms
  nerdbox-vm  . . . . container.Start.....................   1.2ms
  nerdbox-vm  . . . . . crun.start........................   1.2ms

Signed-off-by: David Scott <dave@recoil.org>
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: djs55

api/next.txtpb

@@ -0,0 +1,46 @@
+/*
+	Copyright The containerd Authors.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+	you may not use this file except in compliance with the License.
+	You may obtain a copy of the License at
+
+		http://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+	distributed under the License is distributed on an "AS IS" BASIS,
+	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	See the License for the specific language governing permissions and
+	limitations under the License.
+*/
+
+syntax = "proto3";
+
+package nerdbox.services.traces.v1;
+
+import "google/protobuf/empty.proto";
+
+option go_package = "github.com/containerd/nerdbox/api/services/traces/v1;traces";
+
+service Traces {
+	// Stream exports spans from the VM to the host.
+	rpc Stream(google.protobuf.Empty) returns (stream Span);
+}
+
+message Span {
+	bytes trace_id = 1;
+	bytes span_id = 2;
+	bytes parent_span_id = 3;
+	string name = 4;
+	int64 start_time_unix_nano = 5;
+	int64 end_time_unix_nano = 6;
+	int32 kind = 7;
+	int32 status_code = 8;
+	string status_message = 9;
+	repeated KeyValue attributes = 10;
+}
+
+message KeyValue {
+	string key = 1;
+	string value = 2;
+}

api/proto/nerdbox/services/traces/v1/traces.proto

@@ -0,0 +1,18 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package traces relays OTel spans from the VM to the host.
+package traces