[hung12ct]

What & why

Makes observability and audit logging one call each, enabled purely by env. Without env they do nothing, so the same code runs everywhere. Also fixes a bug that broke the env-only OTel setup.

tel, shutdown, _ := otelsetup.Setup(ctx, otelsetup.Config{ServiceName: "my-agent"})
defer shutdown(ctx)
tel.Instrument(loop, otelllm.WithSystem("anthropic"), otelllm.WithModel(model))

audit, _ := auditlog.FromEnv(ctx) // nil client when GOPHERAGENT_AUDIT_ENDPOINT is unset
defer audit.Close(ctx)
audit.Instrument(loop)

Changes

• Providers.Instrument(loop, ...): wires the loop, its LLM and every registered tool. No-op when disabled; idempotent.
• tools.Registry.Use(mw...): wraps an already-populated registry, including YAML-built ones.
• Fix: OTEL_EXPORTER_OTLP_ENDPOINT=host:port (no scheme, as our docs showed) failed every export with dns resolver: missing address. Scheme-less values are now passed as host:port; URLs still go to the exporter.
• auditlog.FromEnv + Client.Instrument(loop, ...): a nil *Client is a valid disabled client.
• Config.DefaultTenantID: single-tenant apps no longer need WithActor. Before this, every Instrument-produced record failed validation.
• Demo now uses one call each.

Testing

• One-call output matches the manual wiring (OTel span tree and audit trail), calling twice doesn't double anything, and disabled or nil is a no-op. Mutation checks confirm each guard is tested.
• The env-only export test covers both host:port and URL forms; it fails without the fix.
• Ran the real demo with no env (nothing sent) and with env against an OTLP receiver (spans, metrics and audit all arrived).

Checklist

• Title is a Conventional Commit
• gofmt -l . prints nothing
• make lint is clean
• make build passes
• make test and make test-race pass
• Errors wrapped with a package prefix
• CHANGELOG.md updated if this PR is cut as a release tag (at tag time)
• pkg/telemetry/ changes approved by the maintainer