Wire tracing into the composition root

Setup after SetLogger, wrapped rest configs (manager + kubernetes
provider), tracing-outermost provider decorators, and an explicit
trace flush after mgr.Start returns (os.Exit skips defers).

Co-Authored-By: Claude <noreply@anthropic.com>

docs/plans-executions/2026-08-24-1025-otel-tracing.md

@@ -5,7 +5,7 @@ Plan: `docs/plans/2026-08-24-1025-otel-tracing.md`
 - [x] Step 1 — Dependencies
 - [x] Step 2 — New package `internal/tracing`
 - [x] Step 3 — `provider.WithTracing` decorator
-- [ ] Step 4 — `cmd/main.go` wiring
+- [x] Step 4 — `cmd/main.go` wiring
 - [ ] Step 5 — Reconciler spans
 - [ ] Step 6 — Discovery server
 - [ ] Step 7 — GC + health
@@ -81,3 +81,22 @@ One small API addition to `internal/tracing` for this: exported
 and couldn't reach the unexported option resolver. The `cmd/main.go` wiring
 (`WithTracing` outermost around `WithMetrics`) lands with Step 4's commit —
 same file, one commit.
+
+## Step 4 — `cmd/main.go` wiring
+
+As planned: `tracing.Setup` right after `ctrl.SetLogger`; manager rest.Config
+wrapped via `restCfg := ctrl.GetConfigOrDie(); restCfg.Wrap(...)` (the
+previous inline call left nowhere to wrap); providers decorated tracing-
+outermost; explicit trace flush after `mgr.Start` returns on both the error
+and clean paths, with a fresh 10s context since the signal ctx is already
+cancelled by then.
+
+The kubernetes provider grew `NewWithTransportWrapper(ctx, cfg, wrap)` (its
+client is built from its own `ctrl.GetConfig()`, invisible to the manager's
+wrapped config); `New` now delegates with a nil wrapper, so `newWithClient`
+tests stayed untouched, and main registers a closure — the same pattern the
+gcp constructor already used for wire-log options.
+
+Deviation: the plan put `--trace-health-probes` here, but the flag needs the
+`health.Engine.TraceProbes` field that Step 7 introduces — moved there to
+keep every commit compiling.