Add an installed Codex tracing journey

[tt-le]

What & why

Stacked on #718.

Add one installed-product customer journey for the Codex tracing path introduced in #718:

1. Install the checkout wheel and exact Codex version through the integration runner.
2. Configure Codex against eng-ml-inference.staging, where tracing ingestion is enabled.
3. Complete a real headless file task with a unique UUID in the prompt.
4. Wait 30 seconds, query the configured OTel spans table, and require a matching span.

Codex intentionally excludes prompt text from trace-safe spans, so the same UUID is also supplied through Codex's supported otel.span_attributes configuration and queried as ug_integration_marker. This proves the installed Codex → loopback OTLP proxy → gateway → tracing-table path without weakening prompt redaction.

The CI lane is separate from the ordinary live jobs and targets staging until ingestion is available in their production workspace. It requires the staging-scoped UCODE_TRACING_DATABRICKS_BEARER repository secret. The bearer is supplied to ug; Codex sends credential-free OTLP requests to the loopback proxy, which injects the current Databricks token only on the upstream trace request. Inference traffic does not use this proxy.

Testing

• Integration contract and evidence tests pass.
• Ruff check and formatting pass.
• The new test files pass ty.
• Integration collection selects exactly one tracing and codex case; documented suite counts were reconciled with collection.
• A live staging execution was not run locally because no staging credential was selected.

This pull request and its description were written by Isaac.