v0.24.0 — operational foundation pt.1: built-in observability + health/readiness (foundation-first docs)

First slice of the WS-007 operational foundation: a scaffolded service now comes up observable and with health/readiness probes out of the box — each behind a neutral, dependency-light seam (the OTel SDK/exporters live only in the observability/otel adapter, exactly like events/kafkabus).

Observability (#90)

• Built-in OpenTelemetry tracing + RED metrics + structured slog request logging in the default server chain.
• Dependency-light seam: core uses the OTel API only (no-op until an SDK is installed); the SDK + OTLP/stdout exporters are isolated in the new observability/otel adapter. Install it (honors standard OTEL_* env) to activate — zero overhead and no behavioral change without it.
• One trace across the hop: W3C context propagates HTTP gateway → gRPC → handler.
• Redaction on by default: secret-annotated fields never appear in cleartext logs; logs carry trace_id/span_id.

Health & readiness (#91)

• gRPC health service + HTTP /healthz (liveness) and /readyz (readiness).
• Readiness-check seam (health.Check, per-check 2s timeout) + a stdlib DB-ping check; readiness drives the gRPC health status; probes bypass authz. Scaffold wires a DB readiness check.

Docs reposition (#98)

• README + docs home lead with the secure-by-default foundation; secret-fields demoted to one Security instance.

Hardening (#101)

• Fixed a readiness-loop goroutine leak (Serve now owns the loop lifecycle on every return path) and a data race on listener accessors; added regression tests; go test -race clean.

Also

• fix(protoc-gen-ent): correct LoadAggregate edge accessor casing for multi-word edges (#88/#89).

Dependency-light gate: core packages do not import the OTel SDK/exporters — only observability/otel does (enforced by cleancore_test.go).