Commit a sample trace and a walkthrough anyone can run, and fix the collector setup

[rocklambros]

What changed

This gives anyone a committed sample trace and a walkthrough that goes from a fresh clone to a trace file of their own, and it fixes the collector and converter problems Bar found after PR #244 was approved. The walkthrough now runs the same on a second pass, in a shell with a proxy or hostile OTEL_* variables set, and with the collector in a container.

Which issue does this implement

Closes #266
Closes #276
Refs #274

Beyond issue #276

These come from issue #274 and are resolved here, so please look at them on purpose rather than as part of issue #276:

• The audit converter's spans now carry service.name acs-reference-audit-converter instead of the Guardian's acs-reference-guardian. That is the label shipping in 0.1.4. If you'd rather call it something else, such as acs-reference-host-adapter, a rename can land in 0.1.5. Both READMEs say these labels belong to the reference implementation and are not attribution.
• The Guardian sets its batch processor and OTLP compression in code, so OTEL_BSP_* and OTEL_EXPORTER_OTLP_COMPRESSION no longer change what it exports. A loopback endpoint is added to NO_PROXY, so an HTTP_PROXY can't route spans meant for this machine through a proxy. OTEL_EXPORTER_OTLP_*HEADERS still apply because the SDK merges them under anything set in code, and a test pins that so the README stays honest.
• The converter refuses an output that already exists. Before, converting onto the audit log, a hardlink of it, or the Guardian's trace file appended OTLP lines into it, and a second run doubled every span.
• Guardian README fixes: acs.policy.versions is emitted with "" per reference rather than absent, and the converter runs after the agent session has ended.

How it was checked

Every change was premortemed before it was written, built test-first, and reviewed task by task, then as a whole branch.

• bun test: 1217 pass, 1 skip, 0 fail on Bun 1.3.14. The exporter tests also pass on Bun 1.3.11, which CI uses. bun run typecheck is clean and bun run conformance exits 0.
• uv run pytest: 918 passed, 1 skipped. The docs example on the Trace with OpenTelemetry page still matches the regenerated sample with no edit.
• The walkthrough, steps 1 to 6, run literally from a fresh clone at f225652 under umask 022: allow, deny and result spans, one converter span, .acs at drwx------, the converter refusing a second run, and identical counts after "Run it again".
• Step 7 natively with otelcol-contrib 0.162.0: the documented restart keeps both batches at -rw-------, a send with the collector down prints disabled after failure, and the collector file stays readable after a kill -9.
• Step 7 with the README's Docker command, copied verbatim, on Docker Desktop for Mac (arm64): both decisions arrive and the file is 0644 inside a 0700 .acs.
• Steps 2 to 6 with hostile span limits, sampler, resource name, batch queue, gzip and a dead HTTP_PROXY produce the same spans, attributes and labels as a clean run.

Rootless Docker, Podman, SELinux hosts and musl-based Linux haven't been verified, and the README says so.

Base branch

• integration, because this touches the specification, schemas, a reference
  implementation, an adapter, tests, or CI

Type of change

• Reference implementation or adapter
• Documentation

I tested this

• I synced my branch with the base branch before opening this
• uv run pytest -v passes on my machine

Checklist

• Commits are signed off with git commit -s (required by the DCO)
• Prose follows STYLE.md
• No secrets, tokens, or internal URLs in the diff

Security

This narrows exposure. Loopback spans no longer go through a proxy, the collector stays on loopback with owner-only output, and the converter can't append into the audit log. The README states the trust boundary: the trace files, the audit log and the collector port are writable by any process running as the user, so the output isn't tamper-evident.

[github-actions]

This pull request's description says it closes #266 #276, which is on the project roadmap. When it merges, GitHub closes that issue and the roadmap counts it as delivered. Please confirm the change delivers the whole issue before merging.

[rocklambros]

@afogel @bar-capsule, this is the last piece before the lab handoff, and I'd love your eyes on it today if you can spare them.

It closes issue #266 (the sample trace and the "Produce a trace" walkthrough) and issue #276 (Bar's four collector and converter finds). It also picks up a few issue #274 items, which are listed under "Beyond issue #276" in the description so you can approve them knowingly rather than by accident.

One thing is a real decision for you. The converter's spans now carry service.name acs-reference-audit-converter, so a reader can tell them from the Guardian's. I'm shipping that name in 0.1.4, and if you'd rather call it something else, like acs-reference-host-adapter, it's a one-line rename for 0.1.5.

I ran the walkthrough from a fresh clone, natively and with the Docker command, and with a deliberately hostile environment. The details are in the description. Please leave comments rather than using "Commit suggestion", because a commit from you would make you the last pusher and cost us an approval.

[bar-capsule]

Approving - the four #276 fixes check out, including the Docker command run verbatim.