fix(runtime-node): report flush failures correctly - #18

`installAutterAutoFlush` still turns each `FlushTarget.forceFlush` into a promise and only inspects settled statuses. If a target implementation internally catches or absorbs exporter failures, this aggregate will treat the flush as successful and call `telemetryStats.markAllFlushed` for `activeFlushTargets` even though data was lost. Blast radius — if this failure path is hit it cascades to the downstream usage that depends on this file: functions `installAutterAutoFlush`, `unregisterFlushTargets`, `debugLog`, `CountingExporter.forceFlush`, `TelemetryStats.markCaptured`, `isDebugEnabled`, `redactAttributes`, `makeRedactor`; scopes `@autter/runtime-node`; dependent files `@opentelemetry/core`, `@opentelemetry/sdk-trace-base`.
Suggested fix:
Require each flush target to preserve failure information from its internal exporter calls, or have this aggregate reject/return false whenever any target reports a hidden exporter failure instead of only checking the outer promise state. Blast radius — if this failure path is hit it cascades to the downstream usage that depends on this file: functions `installAutterAutoFlush`, `unregisterFlushTargets`, `debugLog`, `CountingExporter.forceFlush`, `TelemetryStats.markCaptured`, `isDebugEnabled`, `redactAttributes`, `makeRedactor`; scopes `@autter/runtime-node`; dependent files `@opentelemetry/core`, `@opentelemetry/sdk-trace-base`.

Cycle detection handles circular references, but removing `maxDepth` means `redactValue` now recursively walks every level of an acyclic object or array. A deeply nested runtime value passed to the exported redactor can exhaust the JavaScript call stack and throw into the host application. Retain a traversal-depth/node budget or use an iterative traversal while preserving cycle handling.
Suggested fix:
Preserve the previous depth limit while adding cycle detection: thread a `depth` parameter through `redactValue`, stop recursing when depth reaches 0, and only use the `WeakMap` to break cycles. Keep the existing whitelist/sensitive-key masking behavior unchanged. Blast radius — if this defect reaches production it can fail the downstream usage that depends on this file: functions `redactAttributes`, `makeRedactor`, `redactString`, `redactValue`, `isSensitiveKey`, `redactWith`, `installAutterAutoFlush`, `initAutterServer`; scopes `@autter/runtime-node`; dependent files `@opentelemetry/api`.

This PR mixes a behavior fix for auto-flush failure reporting with a separate behavior change in redaction logic. `packages/runtime-node/src/server.ts` and `packages/runtime-node/src/lifecycle.ts` are the files contributing most to the mix. Split into one PR for the runtime-node auto-flush failure propagation in `packages/runtime-node/src/server.ts` and `packages/runtime-node/src/lifecycle.ts` plus `packages/runtime-node/test/lifecycle.test.mjs`, and a second PR for the recursive/circular attribute redaction changes in `packages/runtime-node/src/redact.ts` with `packages/runtime-node/test/redact.test.mjs`. The server flush path is higher risk because `packages/runtime-node/src/server.ts` has blastRadiusScore 45 and fanIn 1, so it deserves isolated review. Blast radius — if the refactor introduces a regression the behavior change masks it on: functions `initAutterServer`, `recordLlmCall`, `captureException`, `ErrorTraceRetentionProcessor.forceFlush`, `ErrorTraceRetentionProcessor.flush`, `runWithSpan`, `installAutterAutoFlush`, `redactAttributes`; scopes `@autter/runtime-node`; dependent files `./lifecycle.js`, `./redact.js`, `@opentelemetry/api`, `@opentelemetry/core`, `@opentelemetry/exporter-metrics-otlp-http`, `@opentelemetry/exporter-trace-otlp-http`, `@opentelemetry/instrumentation-http`, `@opentelemetry/resources`.
Suggested fix:
Split this PR so refactors land separately from behavior changes.
Pure-refactor PRs should preserve behavior (no test changes beyond renames). Behavior-change PRs should focus on a single new capability.
Start by extracting `packages/runtime-node/src/server.ts`'s refactor portion (or its behavior portion, whichever is smaller) into its own PR.

The changed redactValue recursively descends every nested array/object with no depth or work bound (line 149). Consequently a sufficiently deeply nested but acyclic caller-supplied Attributes value throws RangeError before redaction returns. initAutterServer installs the compiled redactor (line 719), and both its captureException and captureMessage callers spread activeRedactor(attributes) without a guard (lines 824 and 868); the captured error/message is therefore not emitted and the synchronous capture API can unexpectedly throw into application or global-error call chains. The previous contract bounded traversal at four levels.
Suggested fix:
Use an iterative traversal with an explicit depth/work limit, or restore a safe depth bound while preserving cycle handling. Ensure values beyond the limit are returned or replaced safely so activeRedactor never throws for arbitrary Attributes.

The new deep traversal recurses once per array/object nesting level with no depth or work bound. `redactAttributes` and the compiled `activeRedactor` both invoke this path for caller-provided attributes; notably `initAutterServer` configures it at server startup and `captureException` passes its attributes into it before creating the span. An acyclic object (or array) nested beyond the JavaScript stack limit therefore throws `RangeError` at this recursive call instead of returning safe attributes, causing the telemetry capture path itself to fail. The WeakMap only terminates cycles and does not protect this reachable acyclic input.
Suggested fix:
Bound redaction traversal with a maximum depth/work budget, or rewrite it iteratively. Preserve cycle handling and ensure values beyond the budget are returned or replaced safely without throwing.

The new deep traversal calls `redactValue` recursively for every nested array element and object property with no depth or work limit. A caller can supply an acyclic attribute nested beyond the JavaScript stack limit; that produces `RangeError` before `redactAttributes` returns. The active capture path spreads `activeRedactor(attributes)` while creating error spans (server.ts:819-825), so this failure escapes `captureException` and prevents the exception from being recorded. WeakMap only breaks cycles and cannot protect an arbitrarily deep acyclic value.
Suggested fix:
Replace recursive traversal with an iterative walk bounded by an explicit depth/work budget, or restore a safe maximum depth. Preserve the copy/no-mutation and cycle behavior, and make inputs beyond the budget resolve to a safe non-throwing value that cannot leak nested secrets.

`installAutterAutoFlush` still turns each `FlushTarget.forceFlush` into a promise and only inspects settled statuses. If a target implementation internally catches or absorbs exporter failures, this aggregate will treat the flush as successful and call `telemetryStats.markAllFlushed` for `activeFlushTargets` even though data was lost. Blast radius — if this failure path is hit it cascades to the downstream usage that depends on this file: functions `installAutterAutoFlush`, `unregisterFlushTargets`, `debugLog`, `CountingExporter.forceFlush`, `TelemetryStats.markCaptured`, `isDebugEnabled`, `redactAttributes`, `makeRedactor`; scopes `@autter/runtime-node`; dependent files `@opentelemetry/core`, `@opentelemetry/sdk-trace-base`.
Suggested fix:
Require each flush target to preserve failure information from its internal exporter calls, or have this aggregate reject/return false whenever any target reports a hidden exporter failure instead of only checking the outer promise state. Blast radius — if this failure path is hit it cascades to the downstream usage that depends on this file: functions `installAutterAutoFlush`, `unregisterFlushTargets`, `debugLog`, `CountingExporter.forceFlush`, `TelemetryStats.markCaptured`, `isDebugEnabled`, `redactAttributes`, `makeRedactor`; scopes `@autter/runtime-node`; dependent files `@opentelemetry/core`, `@opentelemetry/sdk-trace-base`.

Cycle detection handles circular references, but removing `maxDepth` means `redactValue` now recursively walks every level of an acyclic object or array. A deeply nested runtime value passed to the exported redactor can exhaust the JavaScript call stack and throw into the host application. Retain a traversal-depth/node budget or use an iterative traversal while preserving cycle handling.
Suggested fix:
Preserve the previous depth limit while adding cycle detection: thread a `depth` parameter through `redactValue`, stop recursing when depth reaches 0, and only use the `WeakMap` to break cycles. Keep the existing whitelist/sensitive-key masking behavior unchanged. Blast radius — if this defect reaches production it can fail the downstream usage that depends on this file: functions `redactAttributes`, `makeRedactor`, `redactString`, `redactValue`, `isSensitiveKey`, `redactWith`, `installAutterAutoFlush`, `initAutterServer`; scopes `@autter/runtime-node`; dependent files `@opentelemetry/api`.

This PR mixes a behavior fix for auto-flush failure reporting with a separate behavior change in redaction logic. `packages/runtime-node/src/server.ts` and `packages/runtime-node/src/lifecycle.ts` are the files contributing most to the mix. Split into one PR for the runtime-node auto-flush failure propagation in `packages/runtime-node/src/server.ts` and `packages/runtime-node/src/lifecycle.ts` plus `packages/runtime-node/test/lifecycle.test.mjs`, and a second PR for the recursive/circular attribute redaction changes in `packages/runtime-node/src/redact.ts` with `packages/runtime-node/test/redact.test.mjs`. The server flush path is higher risk because `packages/runtime-node/src/server.ts` has blastRadiusScore 45 and fanIn 1, so it deserves isolated review. Blast radius — if the refactor introduces a regression the behavior change masks it on: functions `initAutterServer`, `recordLlmCall`, `captureException`, `ErrorTraceRetentionProcessor.forceFlush`, `ErrorTraceRetentionProcessor.flush`, `runWithSpan`, `installAutterAutoFlush`, `redactAttributes`; scopes `@autter/runtime-node`; dependent files `./lifecycle.js`, `./redact.js`, `@opentelemetry/api`, `@opentelemetry/core`, `@opentelemetry/exporter-metrics-otlp-http`, `@opentelemetry/exporter-trace-otlp-http`, `@opentelemetry/instrumentation-http`, `@opentelemetry/resources`.
Suggested fix:
Split this PR so refactors land separately from behavior changes.
Pure-refactor PRs should preserve behavior (no test changes beyond renames). Behavior-change PRs should focus on a single new capability.
Start by extracting `packages/runtime-node/src/server.ts`'s refactor portion (or its behavior portion, whichever is smaller) into its own PR.