chore(supervisor): merge instance lifecycle owner into provider token resolvers

Merge refactor/4700-instance-lifecycle-owner/drew, which replaces the
supervisor's duplicate instance status and trace context types with the
session-control wire types. Keeps the gateway provider identity source and
token resolver selection of this branch.

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

crates/openshell-supervisor/src/lib.rs

@@ -38,6 +38,7 @@ use std::time::Duration;
 use tracing::{Instrument as _, debug, info, warn};
 
 use openshell_core::PolicyValidationFailureMode;
+use openshell_sandbox_backend::session_control::RegistrationTraceContext;
 
 use openshell_ocsf::{
     ActionId, ActivityId, AppLifecycleBuilder, ConfidenceId, ConfigStateChangeBuilder,
@@ -741,27 +742,18 @@ pub fn sandbox_instance_event_context(
     }
 }
 
-/// W3C trace context of the operation that launched a sandbox generation.
-#[derive(Clone, Debug, PartialEq, Eq)]
-pub struct TraceContext {
-    pub traceparent: String,
-    pub tracestate: Option<String>,
-}
-
-impl TraceContext {
-    /// The context a driver passed to a dedicated supervisor process.
-    #[must_use]
-    pub fn from_environment() -> Option<Self> {
-        let traceparent = std::env::var(openshell_otel::TRACEPARENT_ENV)
+/// The trace context a driver passed to a dedicated supervisor process.
+#[must_use]
+pub fn trace_context_from_environment() -> Option<RegistrationTraceContext> {
+    let traceparent = std::env::var(openshell_otel::TRACEPARENT_ENV)
+        .ok()
+        .filter(|value| !value.is_empty())?;
+    Some(RegistrationTraceContext {
+        traceparent,
+        tracestate: std::env::var(openshell_otel::TRACESTATE_ENV)
             .ok()
-            .filter(|value| !value.is_empty())?;
-        Some(Self {
-            traceparent,
-            tracestate: std::env::var(openshell_otel::TRACESTATE_ENV)
-                .ok()
-                .filter(|value| !value.is_empty()),
-        })
-    }
+            .filter(|value| !value.is_empty()),
+    })
 }
 
 /// Trusted launch inputs of one supervised sandbox instance.
@@ -795,7 +787,7 @@ pub struct SandboxInstanceConfig {
     pub admitted_isolation_backend: Option<String>,
     pub main_exit_marker: Option<std::path::PathBuf>,
     /// Parent of the startup span.
-    pub trace_context: Option<TraceContext>,
+    pub trace_context: Option<RegistrationTraceContext>,
     /// How this instance obtains provider access tokens.
     pub provider_identity: openshell_supervisor_network::run::ProviderIdentitySource,
     pub proxy_tls: openshell_supervisor_network::run::ProxyTlsFiles,

crates/openshell-supervisor/src/main.rs

@@ -586,7 +586,7 @@ fn main() -> Result<()> {
                     auth_bundle,
                     admitted_isolation_backend: Some(admitted_backend),
                     main_exit_marker: args.main_exit_marker,
-                    trace_context: openshell_supervisor::TraceContext::from_environment(),
+                    trace_context: openshell_supervisor::trace_context_from_environment(),
                     provider_identity:
                         openshell_supervisor_network::run::ProviderIdentitySource::WorkloadApi(
                             std::env::var_os(