Add provider.WithTracing decorator mirroring WithMetrics

Co-Authored-By: Claude <noreply@anthropic.com>

docs/plans-executions/2026-08-24-1025-otel-tracing.md

@@ -4,7 +4,7 @@ Plan: `docs/plans/2026-08-24-1025-otel-tracing.md`
 
 - [x] Step 1 — Dependencies
 - [x] Step 2 — New package `internal/tracing`
-- [ ] Step 3 — `provider.WithTracing` decorator
+- [x] Step 3 — `provider.WithTracing` decorator
 - [ ] Step 4 — `cmd/main.go` wiring
 - [ ] Step 5 — Reconciler spans
 - [ ] Step 6 — Discovery server
@@ -67,3 +67,17 @@ instead of relying on the global, so behavior is deterministic under tests
 and when tracing is disabled. `Setup` tests reset the global provider to a
 fresh noop per case — restoring otel's own default delegate triggers a
 "Setting tracer provider to its current value" warning from the SDK.
+
+## Step 3 — `provider.WithTracing`
+
+`internal/provider/tracing.go` mirrors `metrics.go` exactly (same wrap shape,
+same `resultLabel` classification reused as the `provider.result` span
+attribute); tests reuse `staticProvider` from `metrics_test.go`. `ErrNotFound`
+maps to span status Ok as planned — the reconciler polls `Get` to NotFound
+during replacement/deletion, so it's an answer, not a failure.
+
+One small API addition to `internal/tracing` for this: exported
+`tracing.Tracer(opts...)`, since the decorator lives in package `provider`
+and couldn't reach the unexported option resolver. The `cmd/main.go` wiring
+(`WithTracing` outermost around `WithMetrics`) lands with Step 4's commit —
+same file, one commit.