feat(resume-build): add optional telemetry/tracing support

[arkamar]

Wire telemetry.New() into resume-build so traces and metrics are exported when OTEL_COLLECTOR_GRPC_ENDPOINT is set. When unset, behavior is unchanged (noop client, zero overhead).

---

This is useful for sandbox debugging.

[cursor]

PR Summary

Low Risk
Low risk because telemetry is only activated when OTEL_COLLECTOR_GRPC_ENDPOINT is set; otherwise it uses a noop client. Main risk is added startup/shutdown paths that could fail or slightly impact performance when exporting metrics/traces.

Overview
resume-build now initializes a telemetry client and uses its MeterProvider for TCP firewall and block metrics instrumentation, exporting metrics/traces/logs when OTEL_COLLECTOR_GRPC_ENDPOINT is set and shutting telemetry down on exit. The shared telemetry package adds NewAnonymous to simplify creating a client for CLIs/tools by auto-filling resource metadata (hostname, generated instance ID, and default commit/version).

^{Reviewed by Cursor Bugbot for commit c418c9a. Bugbot is set up for automated code reviews on this repo. Configure here.}