feat(infra): Tempo + Prometheus + Grafana observability backplane in compose (refs #122)

Three built images on the cg network with config baked in: Tempo (OTLP ingest,
ports 4317/4318), Prometheus, and Grafana with both datasources auto-provisioned.
Config lives in infra/observability/. The verify-observability step runs early in
CI verify-stack; the three containers are added to the failure log-dump list.
Tempo's Grafana plugin has no datasource /health method, so the check proves
Tempo reachability through Grafana's datasource proxy instead.

refs #122

infra/observability/grafana/Dockerfile

@@ -0,0 +1,4 @@
+# Grafana with datasources baked in via provisioning (S-16a, ADR-0023).
+# Dashboards (S-16c, #124) are added under provisioning/dashboards later.
+FROM grafana/grafana:11.3.0
+COPY provisioning/ /etc/grafana/provisioning/

infra/observability/grafana/provisioning/datasources/datasources.yaml

@@ -0,0 +1,17 @@
+# Auto-provisioned datasources (S-16a, ADR-0023). Fixed uids so dashboards (S-16c)
+# and the verify-observability check can reference them by a stable id.
+apiVersion: 1
+
+datasources:
+  - name: Prometheus
+    uid: prometheus
+    type: prometheus
+    access: proxy
+    url: http://prometheus:9090
+    isDefault: true
+
+  - name: Tempo
+    uid: tempo
+    type: tempo
+    access: proxy
+    url: http://tempo:3200

infra/observability/prometheus/Dockerfile

@@ -0,0 +1,2 @@
+FROM prom/prometheus:v2.55.1
+COPY prometheus.yml /etc/prometheus/prometheus.yml

infra/observability/prometheus/prometheus.yml

@@ -0,0 +1,10 @@
+# Prometheus scrape config (S-16a, ADR-0023). For the backplane slice it scrapes
+# only itself; the .NET services' /metrics scrape targets are added in S-16c
+# (#124) when the services expose metrics.
+global:
+  scrape_interval: 15s
+
+scrape_configs:
+  - job_name: prometheus
+    static_configs:
+      - targets: ['localhost:9090']

infra/observability/tempo/Dockerfile

@@ -0,0 +1,4 @@
+# Tempo with our config baked in — so it reaches sibling containers on the CI
+# runner without the external-config-volume dance the upstream CG images need.
+FROM grafana/tempo:2.6.1
+COPY tempo.yaml /etc/tempo.yaml

infra/observability/tempo/tempo.yaml

@@ -0,0 +1,27 @@
+# Grafana Tempo — single-binary, all-in-one, local storage (S-16a, ADR-0023).
+# Ingests OTLP directly (services export straight to Tempo; no collector hop).
+# Storage is ephemeral container fs — this is a local/CI demo backplane, not a
+# retention target. ponytail: local backend, swap for object storage if traces
+# must outlive the stack.
+server:
+  http_listen_port: 3200
+
+distributor:
+  receivers:
+    otlp:
+      protocols:
+        grpc:
+          endpoint: 0.0.0.0:4317
+        http:
+          endpoint: 0.0.0.0:4318
+
+ingester:
+  max_block_duration: 5m
+
+storage:
+  trace:
+    backend: local
+    local:
+      path: /var/tempo/blocks
+    wal:
+      path: /var/tempo/wal