Add attribution confidence for SFT exports

[vincentwuxi]

Summary

• add span attribution metadata: label, source, and confidence
• derive high-confidence attribution from eBPF process metadata or configured trusted request headers
• persist attribution metadata in DuckDB and ClickHouse and expose it through span/trace read models
• add min_attribution_confidence to trajectory export so SFT batches can skip ambiguous-source turns

Boundaries

• eBPF process attribution still wins when present
• gateway/passive capture only gets high-confidence attribution when a configured HTTP header is visible
• mTLS SAN is not parsed directly; gateways should promote it into a trusted header first
• current confidence values emitted by Heron are high and ambiguous; medium is reserved for future correlation strategies

Validation

• cargo check --workspace
• cargo test -p h-llm attribution
• cargo test -p h-api export
• cargo test -p h-storage-duckdb
• cargo test --workspace --no-run
• cargo test -p h-storage-duckdb phase8_otel_rename_migrates_tables_columns_and_backfills_kind
• git diff --check

[vaderyang]

Prefer a solution without database migration. This is not a prioritized feature, but it triggers database migration which is not preferable.