Proxy-to-OTEL migration for attached machines

[philcunliffe]

Parent

Implementation spec: #798 (LLP 0245).

What to build

One command migrates a proxy-attached machine: hyp attach claude removes the proxy env keys, unwinds the launchd env, offers detach --purge for the CA trust, and writes the OTEL block. Sessions started before the flip keep proxying until restart; the overlap is harmless because both producers dedupe into the same rows.

Acceptance criteria

• Migration covered by unit tests: proxy marker becomes otel marker, proxy keys released, nothing else touched
• launchd env unwind invoked on macOS; CA purge offered but never forced
• Overlap-window dedupe asserted (same session via proxy rows and OTEL rows lands once)
• hyp status reflects the new attach mode after migration

Blocked by

• OTEL attach and detach mode for the claude client, with version floor #806