feat(P3.3): OTel bridge + idempotency fidelity fixes it surfaced

AttestoSpanProcessor (attesto.otel / @attesto/sdk) turns ended OTel spans
into commitment events: source_ref otel:{trace_id}:{span_id} so resending
a span is idempotent, only allowlisted attributes committed (as a
commitment, never raw — non-allowlisted values provably absent from
stored objects), fail-open with onError, strict opt-in. Both
implementations are structurally compatible with the SpanProcessor
interface, so neither SDK gains an opentelemetry dependency.

Building this surfaced two real gaps, fixed in all three languages:
- Emulators now deduplicate on (source_kind, source_ref) like real
  ingestion (resend returns the existing receipt; anonymous empty refs
  exempt) — previously a resend silently appended a duplicate event.
- P1.6 head tracking treated an exact idempotent replay (same seq_no AND
  same event_hash as the stored head) as a fork; it is now a benign no-op,
  while same-seq/different-hash remains AttestoForkDetected (regression
  tests in Python, TypeScript-path via emulator test, and Go).

Suites: Python 109 passed, TypeScript 77 passed, Go 4/4 packages ok.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

heads.go

@@ -144,6 +144,11 @@ func (s *FileHeadStore) Set(streamID string, seqNo int64, eventHash string) {
 // does not chain. A forward gap is accepted and advances.
 func checkAndAdvanceHead(store HeadStore, receipt EventReceipt) error {
 	if storedSeq, storedHash, ok := store.Get(receipt.StreamID); ok {
+		if receipt.SeqNo == storedSeq && receipt.EventHash == storedHash {
+			// Benign idempotent replay: the server deduplicated a resend and
+			// returned the same receipt for the same event.
+			return nil
+		}
 		if receipt.SeqNo <= storedSeq ||
 			(receipt.SeqNo == storedSeq+1 && receipt.PrevEventHash != storedHash) {
 			return &ForkDetectedError{