otel: add VM→host span relay for full container lifecycle tracing

Add a Traces.Stream ttrpc service that relays OTel spans from inside
the VM back to the host, mirroring the existing Events.Stream pattern.

VM-side:
- Channel-backed SpanExporter buffers spans (cap 1024, silent drop)
- TracerProvider with 100ms batch interval drains into the channel
- Traces ttrpc service streams spans to the host on demand
- Spans added to: task.Create/Start, runc.NewContainer, crun.create/
  start, ctrnetworking.Connect, mountutil.All

Host-side (shim):
- After VM boot, subscribes to Traces.Stream
- Converts proto spans to ReadOnlySpan via tracetest.SpanStub.Snapshot
- Corrects VM-vs-host clock skew using offset from first span
- Re-exports via OTLP HTTP with service.name=nerdbox-vm
- Spans added to: shim.BundleLoad, shim.VMBoot, shim.BundleTransfer,
  shim.IOSetup, shim.TaskCreate, shim.Start

Signed-off-by: David Scott <dave@recoil.org>

Author: djs55

api/next.txtpb

@@ -0,0 +1,46 @@
+/*
+	Copyright The containerd Authors.
+
+	Licensed under the Apache License, Version 2.0 (the "License");
+	you may not use this file except in compliance with the License.
+	You may obtain a copy of the License at
+
+		http://www.apache.org/licenses/LICENSE-2.0
+
+	Unless required by applicable law or agreed to in writing, software
+	distributed under the License is distributed on an "AS IS" BASIS,
+	WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+	See the License for the specific language governing permissions and
+	limitations under the License.
+*/
+
+syntax = "proto3";
+
+package nerdbox.services.traces.v1;
+
+import "google/protobuf/empty.proto";
+
+option go_package = "github.com/containerd/nerdbox/api/services/traces/v1;traces";
+
+service Traces {
+	// Stream exports spans from the VM to the host.
+	rpc Stream(google.protobuf.Empty) returns (stream Span);
+}
+
+message Span {
+	bytes trace_id = 1;
+	bytes span_id = 2;
+	bytes parent_span_id = 3;
+	string name = 4;
+	int64 start_time_unix_nano = 5;
+	int64 end_time_unix_nano = 6;
+	int32 kind = 7;
+	int32 status_code = 8;
+	string status_message = 9;
+	repeated KeyValue attributes = 10;
+}
+
+message KeyValue {
+	string key = 1;
+	string value = 2;
+}

api/proto/nerdbox/services/traces/v1/traces.proto

@@ -0,0 +1,18 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package traces relays OTel spans from the VM to the host.
+package traces