[codex] Initialize exec-server OpenTelemetry at startup (#25019)

## Summary

- Initialize stderr tracing and the configured OpenTelemetry provider
for local and remote `codex exec-server` startup.
- Instrument the local and remote server entrypoints with a root runtime
span.
- Keep raw Noise environment, registration, and stream identifiers out
of exported spans while preserving them in local debug events.
- Keep telemetry setup in a focused CLI module instead of growing the
top-level command entrypoint.

## Stack

- Previous: none (`#27058` has merged)
- Next: #27466

## Validation

- `just test -p codex-exec-server --lib` (139 passed)
- `just test -p codex-cli --test exec_server` (3 passed)
- `just bazel-lock-check`
- `just fix -p codex-exec-server -p codex-cli`
- `just fmt`

---------

Co-authored-by: Richard Lee <richardlee@openai.com>

codex-rs/exec-server/src/noise_relay/harness.rs

@@ -86,12 +86,10 @@ where
     let (outgoing_tx, mut outgoing_rx) = mpsc::channel(CHANNEL_CAPACITY);
     let (incoming_tx, incoming_rx) = mpsc::channel(CHANNEL_CAPACITY);
     let (disconnected_tx, disconnected_rx) = watch::channel(false);
-    let stream_span = tracing::debug_span!(
-        "noise_relay.stream",
-        noise_side = "harness",
-        environment_id = %environment_id,
-        executor_registration_id = %executor_registration_id,
-        stream_id = %stream_id,
+    let stream_span = tracing::debug_span!("noise_relay.stream", noise_side = "harness",);
+    debug!(
+        environment_id,
+        executor_registration_id, stream_id, "Noise harness relay details"
     );
 
     let websocket_task = tokio::spawn(async move {

codex-rs/exec-server/src/relay.rs

@@ -440,15 +440,7 @@ pub(crate) trait HarnessKeyValidator: Send + Sync {
 ///
 /// Parsing the first Noise message authenticates the harness key. Only a
 /// successful registry check turns that pending handshake into a virtual stream.
-#[tracing::instrument(
-    level = "debug",
-    skip_all,
-    fields(
-        noise_side = "executor",
-        environment_id = %environment_id,
-        executor_registration_id = %executor_registration_id,
-    )
-)]
+#[tracing::instrument(level = "debug", skip_all, fields(noise_side = "executor"))]
 pub(crate) async fn run_multiplexed_environment<S, V>(
     stream: WebSocketStream<S>,
     processor: ConnectionProcessor,
@@ -460,6 +452,10 @@ pub(crate) async fn run_multiplexed_environment<S, V>(
     S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
     V: HarnessKeyValidator + Clone + 'static,
 {
+    debug!(
+        environment_id,
+        executor_registration_id, "Noise executor relay details"
+    );
     let (mut websocket_sink, mut websocket_stream) = stream.split();
     let (physical_outgoing_tx, mut physical_outgoing_rx) =
         mpsc::channel::<Vec<u8>>(CHANNEL_CAPACITY);

codex-rs/exec-server/src/remote.rs

@@ -408,6 +408,11 @@ impl RemoteEnvironmentConfig {
 /// reconnects. The registration and rendezvous URL are also reused until
 /// rendezvous rejects the URL, at which point the next attempt registers again.
 /// The websocket carries cleartext routing metadata and encrypted payloads.
+#[tracing::instrument(
+    name = "codex.exec_server",
+    skip_all,
+    fields(otel.kind = "internal")
+)]
 pub async fn run_remote_environment(
     config: RemoteEnvironmentConfig,
     runtime_paths: ExecServerRuntimePaths,

codex-rs/exec-server/src/server.rs

@@ -13,6 +13,11 @@ pub use transport::ExecServerListenUrlParseError;
 
 use crate::ExecServerRuntimePaths;
 
+#[tracing::instrument(
+    name = "codex.exec_server",
+    skip_all,
+    fields(otel.kind = "internal")
+)]
 pub async fn run_main(
     listen_url: &str,
     runtime_paths: ExecServerRuntimePaths,