feat: trace Codex, Worker, retrieval and session persistence

[ustccjw001]

Codex's existing call_llm Span covers an entire execution, remote Worker subscriptions previously lacked a trace context, and knowledge/memory operations had no independent spans. This change records individual Responses Shim backend requests, Worker control requests and each SSE connection, plus knowledge search, memory search, memory save and database-backed session event persistence. It reuses the existing OTel Provider/exporter and preserves public signatures, backend arguments, authentication, idempotency, retry limits and event cursors.

SSE spans remain detached across async-generator yields. Retrieval spans inherit the caller context, including calls through asyncio.to_thread, and finish on success, failure or cancellation. Handled memory-search failures retain the existing empty-result API but are marked ERROR; successful empty results remain successful. Trace attributes use a fixed whitelist, errors retain types only, and telemetry failures neither block nor repeat business operations. Built-in SQLite/MySQL/PostgreSQL session factories record non-partial append_event operations through an internal ADK subclass; caller-owned SessionService objects remain untouched. The Span covers the storage call, not individual SQL statements. Bilingual design and tracing contracts document the boundaries.

Validation: after installing the repository-declared dev/extensions/codex/sandbox extras, 199 affected tests pass without skips, including the previously failed Harness/Codex suites, Sandbox suites, retrieval/memory, tool-to-retrieval context and Worker requests. The retrieval helper's earlier coverage run measured 100% lines and 98% combined branch coverage. All-files pre-commit passes Ruff and both secret scanners. Full parallel regression for the session-persistence revision passes: 6704 passed, 50 skipped and 4 xfailed (484.07 seconds). The 32 affected checks include actual ADK Runner and SQLite persistence, cancellation, error redaction and telemetry failure. Skipped behavior is not claimed validated. Existing dependency warnings remain. Metrics export to the local localhost:8000 collector was unavailable, so this run does not prove remote observability reception.

Limits: the model backend is non-streaming, so no TTFT is inferred; whole-turn usage is not duplicated. SSE duration includes consumer time. Cancelling a thread-backed retrieval ends the caller span but does not prove the underlying backend has stopped. Internal vector/reranking stages, complete cross-turn Task/HIL aggregation, deployed versions, APMPlus reception and real Playground performance remain unverified. The Worker service receiver implementation is reviewed separately; no merge or deployment is performed by this PR.