## Why
Exec-server process and network-policy events need stable attribution to the
launching tool call and executor without recording process payloads.
## What changed
- Add optional `ExecMetadata` to `ExecParams` and propagate the thread and tool
call IDs from unified exec.
- Emit bounded OpenTelemetry events for process start, spawn failure, sandbox
denial, and exit. Correlate them with the launch trace and registry-issued
executor identity while excluding arguments, paths, environment values,
output, and error text.
- Preserve launch attribution across long-running processes and reconnects, and
attach the same metadata to network-policy audit events.
- Keep the protocol backward compatible when metadata is omitted, and prevent
invalid trace headers from inheriting an unrelated active span.
## Testing
Add coverage for metadata serialization and propagation, lifecycle event
fields, trace relationships, reconnect behavior, spawn failures, sandbox
denials, and network-policy attribution.
GitOrigin-RevId: 7aa480a7289c73cb95e2c124c35500bb6f0d5084
## Why
Planned executor replacement needs a fresh session without waiting for the old
session's transient-disconnect recovery to finish.
## What changed
- Add `Environment::refresh_connection` for remote Noise registry-backed
environments. It performs a fresh registry lookup, reuses a healthy session
when the executor identity is unchanged, and connects to a replacement when
it has changed.
- Retire superseded sessions and connection attempts so they cannot publish
stale state, accept late RPC results, or replay outstanding work.
- Preserve the existing environment and filesystem handles while replacing the
underlying client, and require a live status probe before refresh succeeds.
## Testing
Add coverage for replacement and session reuse, recovery and connection races,
lookup and handshake failures, handle preservation, and late RPC responses.
GitOrigin-RevId: f1d11208cbfe8af8feb25f6b6b8100da82169a99
