fix(telemetry): preserve requests through instrumentation failures

[rschlaefli]

Optional OpenTelemetry setup, propagation and span callbacks can currently prevent code requests from running or replace their results/errors. Guard those operations while preserving one domain invocation, original error identity, existing trace-header privacy and shutdown behavior.

Span setup degrades to the existing no-op facade; failed injection discards partial carrier writes. Middleware calls next once, and completion instrumentation cannot leak errors through finish/close. Initialization remains one-shot with no retries or new dependencies.

Validation: 52 focused API/service telemetry tests pass, including synthetic enabled-SDK faults across 19 injected failure points. Full API suite 386 and service suite 577 pass before the final fixture-only additions; the affected suite was rerun. Both package builds pass; service emits an existing replay-state cast warning. Scoped Opengrep runs 210 rules with no findings. No application or live exporter was used; screenshots do not apply to this nonvisual backend change.

Reviews: the risk-selected slice review passed with no findings at the 75-confidence threshold. The integrated final review passed with two low, non-blocking findings: a late-setup partial provider/processor shutdown leak that the plan explicitly returns to the parent shutdown scope, and an optional span-annotation maintainability note. The simplification audit (returned to the trusted main session under the documented continuity route) found no net simplification that preserves the fault matrix and exactly-once semantics.

Early draft; no merge, image publication or deployment authority is claimed. See docs/project/2026-09-09-nonfatal-telemetry-plan.md for scope and acceptance.