fix(google-adk-agents): Node workflow loading, OTel composition, and telemetry replay-safety tests

[DABH]

Stacked on #2120 (targets maplexu/google-adk-agents-contrib) — fixes issues found during a telemetry replay-safety assessment of the ADK integration.

What was changed

1. Fix Node workflow-load crashes (failing all 8 Node CI jobs on feat(google-adk-agents): add @temporalio/google-adk-agents package #2120; Bun passes only because it exposes web streams natively).

   • The polyfill loader is now prepended to BundleOptions.workflowInterceptorModules in configureBundler, so it evaluates per-workflow after the activator is set and before user workflow code — regardless of user import order. It exports an empty interceptors factory to satisfy the documented interceptor-module contract. An entry-preload approach was deliberately avoided: entry code evaluates before any activator exists, and in reusable-V8-context mode (the default) that no-op evaluation would be cached permanently, so polyfills would never install.
   • node:async_hooks is shimmed to the sandbox's own workflow-scoped AsyncLocalStorage (same approach as contrib/langsmith), fixing @google/adk's top-level new AsyncLocalStorage(). This is strictly stronger than ADK's own browser fallback shim (context survives awaits) and is deterministic with sandbox-managed lifetime.
   • The loader also installs a deterministic performance shim (timeOrigin / now() mapped onto the sandbox-patched Date.now(), mirroring the shim @temporalio/interceptors-opentelemetry installs from its own workflow runtime module). Un-stubbing @opentelemetry/sdk-trace-base (item 2) exposes @opentelemetry/core's browser build, which dereferences the performance global at module load. ESM workflow files dodge that chain through harmony-import pruning, but tsc-compiled CommonJS workflow files — including the published lib/ artifacts and converter modules that import @google/adk — evaluate it eagerly and failed every workflow task with ReferenceError: performance is not defined.

2. Stop stubbing @opentelemetry/sdk-trace-base and @opentelemetry/resources bundle-wide. Both are pure-JS and sandbox-safe; stubbing them broke composition with @temporalio/interceptors-opentelemetry / OpenTelemetryPlugin — the SDK's only replay-safe workflow span path — failing every workflow task with tracing.BasicTracerProvider is not a constructor, despite the README advising users to compose observability plugins with this one. The node-only OTel packages (exporters, sdk-trace-node, sdk-metrics, sdk-logs, resource detectors) remain stubbed, so ADK's telemetry/setup.js still cannot create an un-gated egress inside the sandbox.

3. Pin @opentelemetry/api to a single copy in the Workflow bundle. ADK pins an exact @opentelemetry/api version while other packages in the bundle (notably @temporalio/interceptors-opentelemetry) may resolve a different one, so the bundle could contain two api copies. ADK's telemetry/tracing.js caches trace.getTracer(...) at module load; if that binds a different copy than the one the OTel interceptor registers its tracer provider on (e.g. a user interceptor or converter module evaluates @google/adk before the interceptor factories run), every ADK span is silently dropped while the interceptor's own spans keep exporting. configureBundler now adds an exact-match ($) resolve.alias entry — the same declarative surface the Worker bundler itself uses — mapping the bare @opentelemetry/api specifier to the copy @google/adk itself resolves (obtained through ordinary Node resolution from ADK's entry point, not a hardcoded path). @opentelemetry/api-logs and subpath imports resolve normally. Precedence is identical in both resolve.alias forms: alias entries resolve first-match-first and the pin is placed first, so it wins the bare specifier over any user alias entry (exact- or prefix-form), while a user prefix-form @opentelemetry/api entry still applies to subpath imports.

4. Telemetry regression tests (telemetry.test.ts, compiled-cjs.test.ts, plus plugin.test.ts contract pins):

   • adkSpansExportOncePerOperationUnderReplay: two-turn agent workflow with [OpenTelemetryPlugin, GoogleAdkPlugin] and maxCachedWorkflows: 0; asserts the history contains ≥3 workflow tasks (replays actually happened) and the in-memory exporter holds exactly 2× call_llm, 2× invocation, 2× invoke_agent assistant for scope gcp.vertex.agent — one span per real operation, none added by replays. The exact-count assertion is gated on a retry-free history: a workflow task retry (timeout/failure) is not a replay and legitimately re-emits its segment's spans, so when a slow runner caused retries the test degrades to a lower bound, which still fails on silently dropped spans. This pins the property that ADK's workflow-side spans export replay-safely through the sink gate, and fails if anything regresses toward the N+1 over-counting we found (and fixed) in the Go and Python ADK adapters (contrib/googleadk: add replay-safe OpenTelemetry provider wrappers sdk-go#2514, Add replay-safe OpenTelemetry meter and logger providers; warn in Google ADK plugin sdk-python#1710).
   • adkSpansExportWhenAdkEvaluatesBeforeInterceptorFactories: a user interceptors.workflowModules entry imports @google/adk, so ADK's module-load trace.getTracer(...) runs before any interceptor factory registers the sandbox tracer provider; exact span counts must still hold — this pins the single-api-copy property of item 3.
   • adkSpansDoNotLeakToProcessGlobalProvider: a worker-process global tracer provider observes zero gcp.vertex.agent spans — pins the isolate boundary the replay-safety rests on.
   • compiled-cjs.test.ts: the tsc-compiled CommonJS workflow layout (what a compiled-TS production worker and the published lib/ artifacts actually run) loads and runs with GoogleAdkPlugin alone, and a custom payload-converter module importing @google/adk works via the documented workaround — the module shapes that crashed on the performance global before item 1's shim.
   • Bundler unit tests pin the un-stub list, the polyfill-loader prepend, and the api-pin alias shape — including its precedence over user alias entries in both the object and array forms — so regressions surface as instant diagnostics rather than E2E timeouts.
   • The suite helpers honor REUSE_V8_CONTEXT like packages/test, so the polyfill loader and telemetry gating can be exercised in per-workflow-VM mode as well as the default reusable-V8-context mode.

5. README: "Telemetry and observability" section. ADK's gen_ai spans (including gen_ai.usage.* token attributes) are created inside the workflow sandbox and are dropped by default; installing the OpenTelemetry interceptors exports them replay-safely (first-execution-only), with the single-api-copy pin documented alongside. Explicit cautions: don't register custom telemetry sinks with callDuringReplay: true (reintroduces over-counting); span export is at-least-once (workflow task retries — unlike replays — can re-emit); call_llm spans carry full request/response payloads as attributes, so point the processor somewhere approved for prompt content. Documents the known gap that custom payload/failure converter modules evaluate before interceptor modules, with the workaround.

Why

ADK records telemetry via the global OpenTelemetry API from code that runs workflow-side. In the Go and Python SDK adapters this caused verified replay over-counting (1 real execution + N replays → N+1 observations of token usage/latency). The TypeScript architecture is immune to that by construction — the isolate-local OTel API plus replay-gated sinks yield exactly one export per real operation — but as written the integration instead lost all agent-loop telemetry silently, and hard-broke the one supported way to get it out. This PR fixes the composition, fixes the Node workflow-load crashes that failed all 8 Node CI jobs on #2120, and pins the replay-safety property with tests so it stays true.

Testing

Full contrib suite on Node v26.5.0 against a real dev server: 57 tests passed, in both the default reusable-V8-context mode and with REUSE_V8_CONTEXT=false (previously the E2E files crashed at workflow load with ReadableStream is not defined). Causality verified by stashing the plugin fixes and reproducing the exact CI failure. ESLint and Prettier clean.

CI status: on the last CI run the google-adk-agents suite passed on every integration job (56/56 at that head), including the five jobs shown as failed — those were cancelled by the job-level timeout-minutes, not by test failures. Three of the five hung in contrib/langsmith (signal-child test timeout; a package this PR does not touch, and the same flake appears on recent main runs — main has since landed #2274 to speed that suite up); the other two had zero test failures and simply exceeded the time budget late in the run. Rebasing the #2120 stack onto current main (picking up #2274) and re-running should get Node CI green.