tests: add generateRandomSpanID and ParentContext error-path coverage

Add three new tests to provider_internal_test.go (package tracing):

- TestGenerateRandomSpanID: verifies the happy path produces a valid
  non-zero 8-byte span ID and that successive calls yield distinct values.
- TestGenerateRandomSpanID_Error: injects a failing crypto/rand.Reader to
  cover the error return path (previously at 83.3%).
- TestParentContext_RandomSpanIDFailure: triggers the genErr != nil branch
  in ParentContext by breaking the random source, verifying the original
  context is returned unchanged (previously uncovered).

Coverage improvements for internal/tracing:
  generateRandomSpanID: 83.3% → 100%
  ParentContext:        92.6% → 100%
  package total:        95.2% → 96.2%

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: github-actions[bot]

internal/tracing/provider_internal_test.go

@@ -1,9 +1,16 @@
 package tracing
 
 import (
+	"context"
+	"crypto/rand"
+	"errors"
 	"testing"
 
 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+	"go.opentelemetry.io/otel/trace"
+
+	"github.com/github/gh-aw-mcpg/internal/config"
 )
 
 func TestMergeOTLPHeaders(t *testing.T) {
@@ -50,3 +57,61 @@ func TestMergeOTLPHeaders(t *testing.T) {
 		})
 	}
 }
+
+// TestGenerateRandomSpanID verifies that generateRandomSpanID produces a valid,
+// non-zero 8-byte span ID and that successive calls produce distinct values.
+func TestGenerateRandomSpanID(t *testing.T) {
+	t.Parallel()
+
+	id, err := generateRandomSpanID()
+	require.NoError(t, err, "generateRandomSpanID should not fail with a healthy rand.Reader")
+	assert.NotEqual(t, trace.SpanID{}, id, "generated span ID should be non-zero")
+
+	id2, err := generateRandomSpanID()
+	require.NoError(t, err)
+	assert.NotEqual(t, id, id2, "successive calls should produce distinct span IDs")
+}
+
+// errorReader is an io.Reader that always returns the configured error.
+type errorReader struct{ err error }
+
+func (r *errorReader) Read(_ []byte) (int, error) { return 0, r.err }
+
+// TestGenerateRandomSpanID_Error verifies that generateRandomSpanID propagates
+// errors from the underlying random source and returns a zero span ID.
+// Must NOT run in parallel: temporarily replaces the global crypto/rand.Reader.
+func TestGenerateRandomSpanID_Error(t *testing.T) {
+	syntheticErr := errors.New("synthetic entropy failure")
+
+	origReader := rand.Reader
+	rand.Reader = &errorReader{err: syntheticErr}
+	defer func() { rand.Reader = origReader }()
+
+	id, err := generateRandomSpanID()
+
+	assert.Equal(t, trace.SpanID{}, id, "span ID should be zero on error")
+	require.Error(t, err, "should return an error when the random source fails")
+	assert.ErrorIs(t, err, syntheticErr, "error should wrap the underlying source error")
+	assert.Contains(t, err.Error(), "failed to generate random span ID")
+}
+
+// TestParentContext_RandomSpanIDFailure verifies that ParentContext returns the
+// original context unchanged when generateRandomSpanID fails due to a broken
+// random source. This covers the genErr != nil branch (lines 322–325 of provider.go).
+// Must NOT run in parallel: temporarily replaces the global crypto/rand.Reader.
+func TestParentContext_RandomSpanIDFailure(t *testing.T) {
+	ctx := context.Background()
+	cfg := &config.TracingConfig{
+		TraceID: "4bf92f3577b34da6a3ce929d0e0e4736", // valid 32-char hex (non-zero)
+		// SpanID intentionally absent so ParentContext must generate one
+	}
+
+	origReader := rand.Reader
+	rand.Reader = &errorReader{err: errors.New("entropy unavailable")}
+	defer func() { rand.Reader = origReader }()
+
+	parentCtx := ParentContext(ctx, cfg)
+
+	assert.Equal(t, ctx, parentCtx,
+		"ParentContext must return the original context when random span ID generation fails")
+}