[RefImpl] Fix the collector config and the converter's span limits before the lab handoff #276

Target runtime or language

AGT reference Guardian: otel-collector.yaml and audit-to-otlp.ts from PR #244

What this proves

The lab reads OTLP output from the reference Guardian. A deeper review of #244 (checked against 8058752, mostly by running it) found four problems a normal lab setup can hit:

• otel-collector.yaml: the file exporter has no append: true, so a collector restart truncates the trace file.
• otel-collector.yaml: the receiver binds 127.0.0.1 inside the container, so the published port gets no reply and the Guardian's endpoint output disables itself. Bind 0.0.0.0 inside, publish to 127.0.0.1, and add the -v/-w flags the relative path needs.
• otel-collector.yaml: output is 0755/0644, while the Guardian's own file is 0700/0600. Add directory_permissions: "0700" and note umask 077.
• audit-to-otlp.ts:201-205: no spanLimits, so OTEL_* limit variables apply. OTEL_ATTRIBUTE_VALUE_LENGTH_LIMIT truncates the session and request ids, which breaks joins, and OTEL_SPAN_EVENT_COUNT_LIMIT=0 drops the failure event. Pass the Guardian's limits.

Fixing them means the handoff artifacts work as documented, in a container and across collector restarts.

Related: #91 (the exporter and its collector config), #266 (the lab sample, whose generator runs the converter), #274 (the other #244 follow-ups), #71 (file modes for files holding request content).

Do you intend to implement this yourself

No, I am proposing it for someone else

Current Priority Scope

Feeds the runnable Guardian reference implementation