fix(core-eslint): enforce ADR-017 OTel SDK import restriction

The base config documented (and carried allowlist off-blocks for) the
OTel-SDK import restriction but the no-restricted-imports pattern group
only covered @sentry/*. Add @opentelemetry/sdk-*, exporter-*,
instrumentation-*, resources and semantic-conventions to the restricted
group, and extend the off-block for core-audit's trace-id enrichment
test, which legitimately builds an in-memory sdk-trace-base tracer.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

packages/core-eslint/base.js

@@ -118,6 +118,17 @@ export default [
               message:
                 "Import from @repo/core-shared/instrumentation instead — feature packages must not depend on Sentry directly.",
             },
+            {
+              group: [
+                "@opentelemetry/sdk-*",
+                "@opentelemetry/exporter-*",
+                "@opentelemetry/instrumentation-*",
+                "@opentelemetry/resources",
+                "@opentelemetry/semantic-conventions",
+              ],
+              message:
+                "OTel SDK imports are restricted to core-shared/instrumentation/otel/ and app init paths — import @repo/core-shared/instrumentation instead (ADR-017).",
+            },
           ],
         },
       ],
@@ -176,6 +187,9 @@ export default [
       "**/instrumentation.{ts,js,mjs}",
       "**/next.config.{mjs,ts,js}",
       "**/vite.config.{ts,mjs,js}",
+      // core-audit's trace-id enrichment test builds a real in-memory tracer
+      // (@opentelemetry/sdk-trace-base) to assert trace-id propagation.
+      "**/trace-id-enriching-audit-log.test.{ts,js}",
     ],
     rules: {
       "no-restricted-imports": "off",