feat(observability): Phase A.2 — verbatim provider.request "after" capture + self-redaction (267 tests)

Threads the step span's correlated logger into provider.stream (new optional ProviderStreamOptions.logger) so provider-openai-compat opens a child provider.request span at the fetch edge, capturing the verbatim post-transform request + response status/cache-tokens/raw-error. Auth header self-redacted in the provider's OWN code (graduated mask tiers; no shared helper). Capture is fail-safe (never throws into the turn). Adds the first hermetic provider HTTP test (stream.test.ts: fetch mocked, 15 cases). Large payloads use attributes for now; the LogRecord.body channel is a deferred ABI design (notes §10).

Verified: tsc -b clean, 267 tests (250->+17), biome 0 warnings/0 infos. Live boot: provider.request shares turnId with prompt:before (before<->after diffable); auth-key leak count = 0 (self-redaction proven on a real request).

1 files changed, 6 insertions, 1 deletions

diff --git a/packages/kernel/src/runtime/run-turn.ts b/packages/kernel/src/runtime/run-turn.ts
index 0f42ef3..a78c31d 100644
--- a/packages/kernel/src/runtime/run-turn.ts
+++ b/packages/kernel/src/runtime/run-turn.ts
@@ -78,6 +78,7 @@ interface StepContext {
 	readonly conversationId: string;
 	readonly turnId: string;
 	readonly logger: Logger;
+	readonly stepLogger: Logger | undefined;
 	readonly toolSpans: Map<string, Span>;
 }
 
@@ -197,7 +198,10 @@ async function executeStep(ctx: StepContext): Promise<StepResult> {
 	);
 
 	try {
-		const stream = ctx.provider.stream(ctx.messages, ctx.tools);
+		const opts = {
+			...(ctx.stepLogger !== undefined ? { logger: ctx.stepLogger } : {}),
+		};
+		const stream = ctx.provider.stream(ctx.messages, ctx.tools, opts);
 		for await (const event of stream) {
 			if (ctx.signal.aborted) break;
 			processEvent(event, chunks, toolCalls, dispatcher, ctx);
@@ -351,6 +355,7 @@ export async function runTurn(input: RunTurnInput): Promise<RunTurnResult> {
 				conversationId,
 				turnId,
 				logger: turnSpan?.log ?? logger ?? createNoopLogger(),
+				stepLogger: logger,
 				toolSpans,
 			});