test(infra): verify-tracing asserts one connected trace across services in Tempo (refs #123)

Generates anonymous BFF→projection-api traffic and asserts Tempo holds a single
trace containing both service.names — proving OTLP export plus traceparent
propagation across the HttpClient hop. Fails until the services are instrumented
(next commit). Runs in-network like the other verify checks.

refs #123

infra/run-tracing-check.sh

@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+#
+# S-16b (#123): assert one connected distributed trace spans the .NET services in Tempo,
+# against an ALREADY-RUNNING full stack. Runs the driver in a python:3-slim container on the
+# stack network (services reached by container IP; the runner can't reach published ports —
+# gitea-actions-gotchas.md §5/§6). Does NOT manage the stack lifecycle.
+set -euo pipefail
+
+here="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+
+ip() { docker inspect -f '{{range .NetworkSettings.Networks}}{{.IPAddress}}{{end}}' "$1"; }
+
+bff="$(docker ps -q --filter 'name=[-_]bff[-_]' | head -1)"
+tempo="$(docker ps -q --filter 'name=[-_]tempo[-_]' | head -1)"
+[ -n "$bff" ] && [ -n "$tempo" ] || { echo "ERROR: bff and/or tempo not running — bring the stack up first" >&2; exit 1; }
+net="$(docker inspect -f '{{range $k,$_ := .NetworkSettings.Networks}}{{$k}}{{"\n"}}{{end}}' "$bff" | head -1)"
+bff_ip="$(ip "$bff")"; tempo_ip="$(ip "$tempo")"
+echo ">> network=$net bff=$bff_ip tempo=$tempo_ip"
+
+cid="$(docker create --network "$net" \
+  -e "BFF=http://$bff_ip:8080" -e "TEMPO=http://$tempo_ip:3200" \
+  -e "TRACING_TIMEOUT=${TRACING_TIMEOUT:-90}" \
+  python:3-slim python /tracing-check.py)"
+docker cp "$here/tracing-check.py" "$cid:/tracing-check.py" >/dev/null
+rc=0; docker start -a "$cid" || rc=$?
+docker rm -f "$cid" >/dev/null
+exit $rc