fix(langgraph): support the locked OpenTelemetry 2 SDK

[Pal Lakatos-Toth (pallakatos)]

Fix the actual LangGraph TypeScript beta image build

Merged into kars-bridge as 3bc7ff58d8d2994e474be39fd2af201d750fc5c2
from qualified head 0f70d285ba9bd3a2ff072c3aca874123d9dc6802.
All 31 required checks and review protections remain intact. No main/release promotion.

Building the public beta candidate exposed two TypeScript errors:
@opentelemetry/resources no longer exports the Resource constructor and
NodeTracerProvider no longer has addSpanProcessor. The manifest and lockfile
already require OpenTelemetry SDK 2.8.0.

This repair uses resourceFromAttributes and constructor spanProcessors,
preserving attributes, endpoints, provider lifecycle and idempotence. No
dependency versions are changed and telemetry is not disabled.

Both Docker dependency stages now use the existing lockfile with npm ci.
The obsolete Vitest basic reporter is replaced by the default reporter.
Four real-SDK/HTTP-collector cases check trace and metric exports, attributes,
endpoint precedence and preservation of the initial provider configuration.
The existing required Runtime OpenClaw Build & Test check retains its name
and prior work, and now also installs, typechecks, builds and tests this adapter.

Qualification

The source image failure and invalid reporter were reproduced. Source syntax,
unchanged lockfile, workflow preservation, copyright/size/crypto/stub gates and
the scoped delegated audit pass locally. The exact SDK 2.8.0 graph is unavailable
locally; cached 1.30.1 was not substituted.

Current-head public job 104341944758 has now passed the locked install,
typecheck, build and all four real trace/metric export regressions with Vitest
4.1.8. Existing OpenClaw tests also passed (274 cases). Bridge CI
34957185912 passed all eleven jobs. The actual linux/amd64 container also
built successfully from exact public head 0f70d285: both Docker npm ci
stages and tsc -p . passed. It is retained separately from the original beta
images; no old image provenance was changed. All 53 reported PR checks
subsequently passed, including the full core and native requirements.
The guarded integration merge restored its temporary review allowance.

All 31 integration checks and source-review protections remain required.
This is a necessary existing-runtime packaging correction, not a new feature.
H100 cleanup/reinstall remains a separate acceptance step using the merged source;
no old/private image is substituted or relabeled as this revision.

[github-actions]

Dependency Review

✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.

Scanned Files

None