test(infra): verify-observability asserts Grafana + Tempo/Prometheus datasources are live (refs #122)

Polls Grafana's datasource-health endpoints so it proves Grafana can actually
reach Tempo and Prometheus over the cg network, not merely that the containers
started. Fails until the backplane is wired (next commit).

refs #122

infra/run-observability-check.sh

@@ -0,0 +1,35 @@
+#!/usr/bin/env bash
+#
+# S-16a (#122): assert the observability backplane is live against the running stack.
+# Not just "the containers started" — it asks Grafana to health-check its provisioned
+# Tempo and Prometheus datasources, which proves Grafana can actually reach both over
+# the `cg` network and that provisioning landed. Polls, so it tolerates a cold Grafana.
+#
+# Usage: run-observability-check.sh   (override GRAFANA_URL / GRAFANA_AUTH / OBS_TIMEOUT)
+set -euo pipefail
+
+GRAFANA="${GRAFANA_URL:-http://localhost:3000}"
+AUTH="${GRAFANA_AUTH:-admin:admin}"
+TIMEOUT="${OBS_TIMEOUT:-60}"
+
+# poll <description> <url> <json-path-expr> <expected>
+poll() {
+  local desc="$1" url="$2" path="$3" want="$4" got deadline
+  deadline=$(( $(date +%s) + TIMEOUT ))
+  while :; do
+    got="$(curl -fsS -u "$AUTH" "$url" 2>/dev/null \
+      | python3 -c "import sys,json;print(json.load(sys.stdin)$path)" 2>/dev/null || true)"
+    [ "$got" = "$want" ] && { echo "  ✓ $desc"; return 0; }
+    if [ "$(date +%s)" -ge "$deadline" ]; then
+      echo "  ✗ $desc — got '$got', want '$want' ($url)" >&2
+      return 1
+    fi
+    sleep 2
+  done
+}
+
+echo "Checking observability backplane at $GRAFANA ..."
+poll "Grafana is healthy"               "$GRAFANA/api/health"                             "['database']" "ok"
+poll "Prometheus datasource reachable"  "$GRAFANA/api/datasources/uid/prometheus/health"  "['status']"   "OK"
+poll "Tempo datasource reachable"       "$GRAFANA/api/datasources/uid/tempo/health"       "['status']"   "OK"
+echo "Observability backplane OK."