Second layer of the `mergify ci junit-process` port — replace the
`opentelemetry-exporter-otlp-proto-http` encode-and-upload path
in `mergify_cli/ci/junit_processing/upload.py` with a call into
a new hidden Rust subcommand, `mergify _internal junit-upload`,
that re-parses the JUnit XML files, builds the OTLP
`ExportTraceServiceRequest` with the quarantine set baked in,
gzips it, and POSTs it to
`/v1/repos/<owner>/<repo>/ci/traces`.

Two new modules under `junit_process`:

- `spans` builds one session span per upload, one suite span per
  `<testsuite>`, and one case span per `<testcase>`, all sharing
  a resource that carries the CI-env attributes the backend uses
  for routing (provider, pipeline run id, branch, head SHA, …).
  The test cases pin parent/child wiring, status-code mapping,
  attribute propagation, and resource scraping by feeding a
  deterministic RNG into a hidden seam. `UploadMetadata` carries
  an optional `run_id` (the bridge passes the same 16-char hex
  Python already printed to its UI; decoded to 8 bytes as the
  session span id) and a `quarantined` name set (each matching
  case span gets `cicd.test.quarantined = true`).

- `upload` POSTs the request with the same headers the Python
  `OTLPSpanExporter` used to send (`Bearer` auth,
  `application/x-protobuf`, `Content-Encoding: gzip`) and
  matches the error wording so any log scrapers tracking Python
  output keep working. Wiremock covers the happy path, the
  empty-request short-circuit, and the 401 error surface.

The detector grows the resource-attribute lookups Python emits
(pipeline name, job name, run id/attempt/url, head/base ref,
head SHA, repository URL, runner name). On GitHub Actions
`pull_request` builds, `GITHUB_SHA` points at the synthetic merge
commit GitHub creates by pre-merging the PR head into the base —
not the actual code the tests ran against. The contributor's real
head SHA lives at `pull_request.head.sha` inside `GITHUB_EVENT_PATH`
and that is the value the dashboards correlate with, so
`get_head_sha` prefers the event payload and falls back to
`GITHUB_SHA` when the payload is missing, malformed, or the build
isn't a PR event. Three unit tests pin the precedence: payload
wins, missing-PR-field falls back, missing-event-file falls back.
The CircleCI PR-build API fallback Python implements stays
Python-side for now — it requires a GitHub REST API client we
don't have on the Rust side yet.

Python's `upload.upload(api_url, token, repository, spans=...)`
becomes
`upload.upload(api_url, token, repository, files=..., run_id=...,
quarantined_names=..., test_framework=..., test_language=...)`.
The caller (`process_junit_files`) extracts `quarantined_names`
from the spans the Python quarantine pass already mutated
(`cicd.test.quarantined is True`) so the Rust span builder
reproduces the same wire shape the Python pipeline used to emit.
The `opentelemetry-exporter-otlp-proto-http` runtime dep is
dropped — `opentelemetry-sdk` stays because the quarantine and
report paths still consume `ReadableSpan` attributes (those move
to native in Phase C).

`opentelemetry-proto` is the only otel dep we pull in on the
Rust side, gated to `gen-tonic-messages + trace` so it boils
down to the prost generated types plus the trace proto module —
no tonic, no otel SDK, no exporter runtime. Compression is
`flate2` and the HTTP layer reuses the existing workspace
`reqwest` to keep the TLS / rustls flavour consistent.

This is a transitional bridge. When Phase C of the port lands
later in the stack (the native `ci junit-process` orchestrator
that subsumes the entire command), the Python side of
`junit-process` and the `_internal junit-upload` subcommand
both go away. Cleanup checklist for that follow-up:
- delete `InternalSubcommand::JunitUpload`,
  `InternalJunitUploadArgs`, `InternalJunitUploadOpts`,
  `NativeCommand::InternalJunitUpload`, and the
  `("_internal", "junit-upload")` entry in `NATIVE_COMMANDS`
- delete `mergify_cli/ci/junit_processing/upload.py`
- drop the remaining `opentelemetry-sdk` Python dep once the
  rest of `process_junit_files` is gone

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
Change-Id: Icbc727166711d76678877aa172ca47c2dcc07ebc