feat(observability): production-readiness PR 4 — request tracing + JS… #79

Job	Run time
Gitleaks (secret scan)	14s
Semgrep (SAST)	25s
OSV-Scanner (SCA)	9s
Trivy (filesystem + container scan)	33s
jscpd (duplication < 3% on touched code)	16s
SBOM (SPDX + CycloneDX)	11s
	1m 48s

Provide feedback