feat: add private ingress serving observability

[TristanSpeakEasy]

Why

The private-ingress stack establishes new serving and trust boundaries, but the earlier checkpoints did not provide a consistent way to distinguish public/private MCP traffic or understand where private admission and authority checks fail. This follow-up adds bounded observability before provisioning work continues.

Stacked on #5922.

What changed

• Add provider-neutral private-ingress operation and duration telemetry for admission, attestation, proxying, endpoint resolution, and OAuth authority revalidation.
• Use closed operation/result/reason/provider dimensions only; no customer identifiers, hosts, URLs, identities, credentials, or raw errors enter metric labels.
• Add the trusted public/private network surface to existing MCP request and rejection metrics.
• Instrument private listener, attestor, TokenReview/cache, endpoint resolution, and OAuth authority outcomes while preserving existing fail-closed behavior.
• Cover dimension clamping, nil safety, public/private classification, unavailable-verifier classification, and attestor host mismatch.

Review notes

• Focus on bounded-cardinality conventions and whether trust-boundary outcomes are classified usefully.
• Public custom-domain and platform traffic remain classified as public; only requests stamped by the private listener after attestation are private.
• Dashboards/alerts and provisioner lifecycle metrics remain separate follow-up scope.

Validation

• mise run test:server ./internal/netingress ./internal/networkingress ./internal/mcp/mcpmetrics ./internal/mcp ./cmd/gram (817 tests)
• mise lint:server
• mise build:server
• git diff --check
• Independent review completed; attestor nil/duration safety, host-mismatch telemetry, and unavailable-verifier classification findings fixed and retested
• cubic review -j could not complete because local Cubic authentication is expired (cubic auth login required)

---

Summary by cubic

Adds the serving observability required by AIS-667 for the private ingress trust boundary: operation and duration metrics for admission, attestation, proxying, endpoint resolution, and OAuth authority revalidation, plus public/private network surface labels on existing MCP metrics. No functional serving behavior changes; the new netingress-attestor OTel flags are off by default, and only clamped operation/result/reason/provider dimensions are emitted, so no customer data enters metric labels.

Review focus

• Confirm bounded-cardinality conventions and classification of trust-boundary outcomes.
• Only requests stamped by the private listener after attestation are private; custom-domain and platform traffic stay public.
• Dashboards, alerts, and provisioner lifecycle metrics are separate follow-up.

^{Written for commit 73f64a2. Summary will update on new commits.}

[linear-code]

AIS-667

[changeset-bot]

⚠️ No Changeset found

Latest commit: 73f64a2

Merging this PR will not cause a version bump for any packages. If these changes should not result in a new version, you're good to go. If these changes should result in a version bump, you need to add a changeset.

This PR includes no changesets

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Click here to learn what changesets are, and how to add one.

Click here if you're a maintainer who wants to add a changeset to this PR

[cubic-dev-ai]

All reported issues were addressed across 20 files

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[TristanSpeakEasy]

Addressed all six actionable Cubic observability findings in commit e008b0f9bc: cached provider attribution, full proxy lifecycle timing, standalone attestor OTel setup, metric metadata, and bounded unknown taxonomy. Original review: #5923 (review)