[3.0] Extensions pre-release fixes (dist bundles test/examples; statsd DNS on probe thread; stddev overflow)

[jbachorik]

Summary

Pre-release fixes for btrace-extensions/* — one packaging defect and two correctness/safety bugs, plus a stale manifest version. Grouped from the module review.

Items

• MAJOR — dist bundles non-shippable extensions. The dist auto-bundles every subproject that applies the extension plugin, with no allow-list, so the integration-test-only btrace-ext-test and both examples/* extensions (whose own READMEs say "not maintained as part of core BTrace") ship in the released extensions/ dir. btrace-dist/build.gradle:516-532. Fix: add an explicit allow-list of extensions to bundle.
• MAJOR — statsd blocking DNS + socket-per-call on the probe thread. StatsdImpl.increment() opens a fresh DatagramSocket and does a blocking InetAddress.getByName() DNS lookup on the probe (application) thread on every call. StatsdImpl.java:32-50. Fix: resolve once and reuse a cached socket/address.
• MAJOR — stddev silently corrupted by overflow. StatsMetricImpl accumulates sum-of-squares in a long (value*value), which overflows for realistic ns-latency inputs and silently corrupts stddev. StatsMetricImpl.java:54,94. Fix: use double accumulation (or a numerically stable online-variance algorithm).
• MINOR — stale BTrace-API-Version: 2.3+. The gradle plugin hard-codes 2.3+ into every extension manifest while the loader default is 3.0+ (ExtensionMetadata.java:141). 3.0 satisfies 2.3+ so there is no functional gate today, but it is misleading and should track the current namespace/version. (Related to the gradle-plugin descriptor issue.)

Also worth reconciling: three descriptor-format variants coexist across the extensions (DSL + legacy @ExtensionDescriptor package-info + @ServiceDescriptor; DSL + @ServiceDescriptor; DSL-only), and the legacy package-infos hard-code version="1.0" that mismatches the manifest.

Owner: extensions / build team.

[jbachorik]

Addressed by #909 (merged 2026-07-19 into develop). All four items verified on develop:

• dist allow-list — btrace-dist/build.gradle:518-525 now bundles an explicit releaseExtensionProjects list (contracts, gpu-bridge, llm-trace, metrics, rag-quality, statsd, utils); btrace-ext-test and the examples/* extensions are no longer picked up. Covered by BTraceJarPackagingTest.
• statsd DNS/socket per call — StatsdImpl resolves the address and opens a single DatagramSocket in initialize(), caches them in an immutable Endpoint, and closes on detach. No lookup or allocation on the probe thread.
• stddev overflow — StatsMetricImpl accumulates squares in a DoubleAdder ((double) value * value), so ns-scale latencies no longer overflow.
• stale API version — BTraceExtensionPlugin.groovy:796 emits BTrace-API-Version: 3.0+.

Small residual, not worth holding this issue open: docs/architecture/ExtensionManifestFormat.md still shows 2.3+ in its example manifest (lines 39, 76, 161) and should be refreshed to 3.0+. The descriptor-format reconciliation mentioned in the trailing note was also out of scope for #909; opening a separate issue if it is still wanted.