feat(otel): attach repository metadata to the resource (#91)

Adds vcs.repository.url.full, vcs.repository.name, vcs.owner.name,
vcs.provider.name, vcs.ref.head.name, vcs.ref.head.type and
vcs.ref.head.revision, so telemetry can be attributed to a repository
and a commit rather than only to a directory on someone's laptop.

Read straight off disk — .git/config, HEAD, refs, packed-refs — never by
invoking git. The plugin runs inside the host process at every session
start, so a subprocess costs more than the data is worth, and the files
are readable whether or not git is on PATH. A linked worktree, where
.git is a file containing `gitdir:`, is handled; that is how this
project is developed, so it is the case most likely to be hit.

Credentials in the remote are always stripped. The whole userinfo
component is dropped, along with query and fragment, because
https://user:ghp_xxx@host/org/repo.git is an ordinary CI remote and that
token would otherwise be published on every span, metric and log the
process emits. scp-like SSH remotes become ssh://host/org/repo rather
than being rewritten to https:// — the transport is a fact about the
checkout and a different scheme would misreport it.

Also moves the branch onto vcs.ref.head.name, the current semantic
convention; vcs.repository.ref.name was deprecated in semconv 1.43 and
is kept as an alias only because opencode-otel-plugin emits it and
dashboards key on it. The branch now comes from HEAD at startup instead
of waiting for the vcs.branch.updated event, so it lands on the first
export rather than racing the deferral window; the event stays as a
fallback.

Verified against this repository's own main clone and linked worktree,
not only synthetic fixtures.

Co-authored-by: Claude Opus 5 <noreply@anthropic.com>