chore: upgrade OpenTelemetry to 2.x (#101)

* chore: add CVE-2026-4926 entry to CHANGELOG

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* chore: upgrade OpenTelemetry to 2.x

- @opentelemetry/resources: ^1.30.1 → ^2.6.1
- @opentelemetry/sdk-trace-base: ^1.30.1 → ^2.6.1
- @opentelemetry/sdk-node: ^0.56.0 → ^0.214.0
- @opentelemetry/instrumentation: ^0.56.0 → ^0.214.0
- @opentelemetry/exporter-trace-otlp-http: ^0.56.0 → ^0.214.0
- @opentelemetry/auto-instrumentations-node: ^0.56.0 → ^0.72.0
- @opentelemetry/semantic-conventions: ^1.30.1 → ^1.40.0
- @opentelemetry/api: ^1.9.0 → ^1.9.1

Migrates new Resource({...}) to resourceFromAttributes({...}) per the 2.x API change.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

* fix: format test files and remove unused variable to pass CI lint checks

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

---------

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: mattpodwysocki

CHANGELOG.md

@@ -7,6 +7,7 @@
 
 ### Dependencies
 
+- **Upgrade OpenTelemetry to 2.x** — upgraded `@opentelemetry/resources` and `@opentelemetry/sdk-trace-base` from `^1.30.1` to `^2.6.1`; upgraded experimental packages (`sdk-node`, `instrumentation`, `exporter-trace-otlp-http`) from `^0.56.0` to `^0.214.0`; upgraded `auto-instrumentations-node` to `^0.72.0` and `semantic-conventions` to `^1.40.0`; migrated `new Resource()` to `resourceFromAttributes()` following the 2.x API change
 - **Upgrade `tshy` to `^4.1.1`, `vitest`/`@vitest/coverage-istanbul` to `^4.1.4`, `typescript` to `^6.0.2`** — removed deprecated `baseUrl` from `tsconfig.base.json` (TS6)
 - **Upgrade `zod` from `^3.25.42` to `^4.3.6`** — migrated all `z.record()` calls to require explicit key schema (`z.string()`), updated test assertions for changed error message format