⬆️ bump @opentelemetry/* deps to ^0.218.0

Picks up CVE-2026-44902 fix (GHSA-q7rr-3cgh-j5r3, patched in 0.217.0)
and enables OTel dedup in consumer trees that pin newer @opentelemetry/*
packages directly.

- runtime: @opentelemetry/sdk-node, @opentelemetry/instrumentation
- devDeps: @opentelemetry/exporter-{trace-otlp-http,trace-otlp-proto,metrics-otlp-proto}

Refs #80

Author: jimmyhoran