feat!: implement the v2 observability contract

[janisto]

Pull Request

Why

Prepare the next major version as an intentionally breaking, privacy-first
observability API. The existing v1 module remains available at the unsuffixed
path; this branch establishes the /v2 module and behavior.

What changed

• Move the module and public imports to /v2 and remove v1 compatibility
  shims.
• Make path, direct peer IP, and User-Agent capture independent opt-ins and
  rename the portable field from remote_ip to peer_ip.
• Add immutable W3C Trace Context Level 1/Level 2 selection and harden request
  IDs, provider presets, status and panic handling, NDJSON framing, and field
  ownership.
• Preserve Echo-native route, response-status, and recovery semantics while
  expanding adversarial regression coverage.
• Add a production-shaped consumer image and a conditional build-only CI
  diagnostic with Podman-first local tooling.

Validation

• just qa: passed
• git diff --check: passed
• Additional checks: just mutation passed with 98.85% efficacy; the consumer
  image built and ran with Podman

Compatibility and risk

• Compatibility impact: Intentional major-version break. Consumers must use
  the /v2 import path, explicitly enable privacy-sensitive fields, migrate
  remote_ip queries to peer_ip, and adopt the documented v2 configuration.
• Security and privacy impact: Raw path, direct peer IP, and User-Agent are
  omitted by default; input and field-ownership checks reject ambiguous or
  spoofed metadata.
• Failure mode and remaining risk: Unmigrated applications fail to compile or
  observe intentionally omitted or renamed fields. Applications must preserve
  the documented middleware order. No module is published by this pull request.

Documentation and changelog

Updated README, examples, maintainer guidance, release and security
documentation, issue forms, consumer image documentation, and CHANGELOG.md.
All v2 entries remain under ## [Unreleased].