fix(deps): bump otlp-transformer to 0.214.0 so npm can resolve the tree

[tejaskash]

Problem

npm install of the CLI (the published tarball, or npm i -g ./agentcore-1.0.0.tgz per the README) fails with ERESOLVE:

• bedrock-agentcore (added in feat(runtime): add interactive shell #2198 for runtime shell) has an optional peer on @strands-agents/sdk
• Strands 1.16.0 has an optional peer on @opentelemetry/sdk-trace-base@^2.6.1
• our pinned @opentelemetry/otlp-transformer@0.213.0 depends on sdk-trace-base@2.6.0, which does not satisfy ^2.6.1

bun does not enforce optional peer ranges, so bun install --frozen-lockfile in CI never hit this. Only npm consumers do, which means every npm install of the published package.

Fix

Bump the transformer pin to 0.214.0. It pins sdk-trace-base@2.6.1, and it is the newest release that still publishes both generated request decoders src/core/dev/otel/collector.ts imports:

transformer	trace decoder	logs decoder	sdk-trace-base
0.213.0 (before)	yes	yes	2.6.0
0.214.0 (after)	yes	yes	2.6.1
0.215.0 to 0.217.0	yes	no	2.7.x
0.218.0 and later	generated root removed

The lockfile diff is the transformer subtree only, 2.6.0 to 2.6.1.

Verification

• bun run typecheck passes
• bun test src/core/dev/otel: 38 pass
• bun test: 2978 pass, 0 fail
• bun run build, then bun pm pack and npm install -g --prefix <tmp> agentcore-1.0.0.tgz succeeds on npm 10.8.2 (the version that failed before), and the installed agentcore --version runs

Follow-ups (not in this PR)

• Nothing in CI installs the packed tarball with npm. A step that does would have caught this.
• The npm install prints EBADENGINE warnings: package.json declares node >=20.12.0 but commander@15, ink@7, and cli-truncate@6 require node 22. Pre-existing.

[agentcore-devx-automation]

Claude Security Review: no high-confidence findings. (run)

[agentcore-devx-automation]

AgentCore Harness Review

Verdict: Looks good

This is a minimal patch that bumps the exact-pinned @opentelemetry/otlp-transformer from 0.213.0 to 0.214.0 in package.json and updates bun.lock accordingly.

Verified:

• The only in-source use is src/cli/operations/dev/otel/collector.ts, which does a deep require('@opentelemetry/otlp-transformer/build/src/generated/root') for the protobuf-generated ExportTraceServiceRequest / ExportLogsServiceRequest types. That path and both symbols still exist in the 0.214.0 tarball, so the exact-pin (which is presumably why the direct dep is here separate from @opentelemetry/exporter-metrics-otlp-http) continues to work.
• No API surface change is being consumed, and no test/source updates are required.

One non-blocking note (feel free to ignore): the local package.json in the workspace still shows ^0.213.0 with a caret — the PR base file has the exact pin. Just double-check that the exact-pin (no ^) is what you want going forward, since the whole reason for keeping this as a direct dep appears to be locking the deep import path across releases.

No changes required to merge.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.05%. Comparing base (92b6a43) to head (bed44bf).

Additional details and impacted files

@@            Coverage Diff            @@
##           refactor    #2224   +/-   ##
=========================================
  Coverage     97.05%   97.05%           
=========================================
  Files           555      555           
  Lines         38385    38385           
=========================================
  Hits          37253    37253           
  Misses         1132     1132           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.