feat(nvca): inject request-trace-uploader sidecar

[kristinapathak]

Why

NVCA environment injection alone cannot deploy the request-trace-uploader. First-class Dynamo support must add the same sidecar image, volumes, credential contract, configuration, health probes, and BYOO signal environment to the DGD-created workload pod template.

Scope

• Add a first-class request-trace-uploader sidecar contract for selected Dynamo components.
• Mount the shared request-trace spool read-write for Dynamo and uploader, plus read-only credentials and uploader state/quarantine storage.
• Inject only the uploader configuration it needs. The credential-source authority remains decoupled from the uploader image.
• Wire the workload-scoped BYOO signal-specific metrics and trace endpoint plus protocol into the uploader container.
• Preserve secret references. Do not copy secret values into ConfigMaps or metadata.
• Add health probes and a named health port. Do not add a PodMonitor for uploader metrics because it exports metrics through OTLP.

Tests

• Render and webhook tests that prove the exact container, image, volume mounts, probes, and environment references are present on a DGD-created pod template.
• SecretKeyRef preservation and non-leakage tests.
• Test that the sidecar receives the same workload-scoped BYOO metric and trace endpoint plus protocol as the Dynamo container.

Non-goals

• Introducing a second uploader implementation.
• Turning generic BYOO environment injection into generic sidecar injection.

Parent: #1004