Story 1438: Carry Trace Context Into agent_invoke.v1

The broker already knew the product truth for an Atlas run: run_id, firm_id, user, and the legacy correlation_id. What it did not carry into AgentCore was the W3C trace carrier. That made the functions side and the agent side harder to join as one server-side trace graph.

Before

{
  "schema": "agent_invoke.v1",
  "meta": {
    "run_id": "...",
    "firm_id": "...",
    "user_id": "...",
    "correlation_id": "..."
  }
}

After

{
  "schema": "agent_invoke.v1",
  "meta": {
    "run_id": "...",
    "firm_id": "...",
    "user_id": "...",
    "correlation_id": "...",
    "traceparent": "00-<trace_id>-<span_id>-<flags>",
    "tracestate": "optional vendor state"
  }
}

Boundary Model

WS route
  -> SQS message attributes: traceparent / tracestate
    -> clerk_worker handler copies attrs onto the command
      -> runner builds agent_invoke.v1 inside functions.agent_invoke.build
        -> AgentCore receives meta.traceparent / meta.tracestate

Scope

Contract	Change
`AgentCommand`	Adds nullable `traceparent` and `tracestate` fields so the worker can bridge queue attributes into the command dictionary.
`InvokeMeta`	Adds nullable `traceparent` and `tracestate` to the strict `agent_invoke.v1` contract.
`correlation_id`	Kept for the #1439 lockstep expand/contract window. This Story does not remove cid.

Observability Rule

The runner uses the shared Python manual_span helper with the closed-registry functions.agent_invoke.build span. The global provider remains owned by the ADOT Lambda bootstrap. Product code does not construct a TracerProvider or call raw tracer APIs.

Recall: Story 1438 adds traceparent/tracestate to the AgentCore invoke meta while preserving run_id, firm_id, and legacy correlation_id for the coordinated #1439 agent-side extraction.