v0.2.0 — Fase 8 (Deploy HA + observabilidad)

Added

• Helm HA: chart deploy/helm/ciel con replicaCount: 2, PodDisruptionBudget
  (minAvailable: 1), HorizontalPodAutoscaler (2–10 réplicas, target CPU 70%),
  podAntiAffinity (topologyKey kubernetes.io/hostname) y
  topologySpreadConstraints (maxSkew 1). Templates hpa.yaml +
  poddisruptionbudget.yaml.
• OTel centralizado (ciel.observability.otel): init_tracing(*, otlp_endpoint) usa OTLPSpanExporter si hay endpoint o InMemorySpanExporter
  por defecto (offline-safe); current_tracer(), span_count() (cuenta spans del
  exporter in-memory), OtlpAuditExporter (sink de auditoría como spans). Comando
  ciel observe y flag --otel/--otel-endpoint en ciel serve.
• Adapters de canal (ciel.adapters): TeamsAdapter, DiscordAdapter,
  WebUIAdapter + FakeAdapter (offline-safe, fakes en tests). Heredan
  MessagingAdapter/Message de ciel.gateway.adapter.
• Routers de gateway (ciel.gateway.messaging): create_teams_webhook_router,
  create_discord_webhook_router, create_webui_router, montados en make_app
  (ciel serve) y exportados en ciel.gateway.__init__.
• Human-in-the-loop (HIL) en ciel.orchestration.graph: GraphNode.require_approval,
  GraphPaused, GraphApprovalDenied, GraphRunner.approve()/deny() con
  chequeo RBAC (enterprise.rbac.check(action="approve:*")). El runner pausa y
  persiste paused=True; reanuda tras aprobación de rol autorizado.
• Runbooks (docs/runbooks/): deploy HA, incidente, rollback, backup de
  audit/board (SQLite), escalado HPA.

Fixed

• ciel.observability.otel.span_count() devolvía -1 siempre: (1) init_tracing
  no persistía _last_provider (faltaba global); (2) accedía a atributos
  inexistentes en opentelemetry-sdk 1.x (active_span_processor/span_exporter).
  Ahora navega provider._active_span_processor._span_processors[].span_exporter
  vía _find_in_memory_exporter.

Verification

• uv run pytest tests/ → 216 passed, 1 skipped (194 base F0–7 + 22 Fase 8:
  test_fase8_hil_otel_test.py 8, test_fase8_adapters_test.py 14).
• Smoke: uv run ciel observe confirma exporter; init_tracing() + span →
  span_count() >= 1; ciel serve monta routers Teams/Discord/WebUI
  (/v1/messaging/{channel}/health → 200); grafo con require_approval pausa y
  reanuda tras aprobación de rol admin (approve:*), bob (viewer) bloqueado.

---