feat: trace-aware testing for autonomous hunt mode

[jithin23-kv]

Area

Autonomous mode (opfor hunt)

Problem or motivation

opfor hunt has no telemetry integration. The structured red-teaming (opfor run) path wires in grounded attack generation (reading real production traces to make attacks targeted) and judge enrichment (fetching the recorded trace after each attack so the judge sees internal tool calls and retrievals, not just the surface reply). None of this is available in hunt mode.

This matters most in hunt mode: the autonomous agent is discovering attack paths adaptively, and without trace context it generates blind probes instead of attacks grounded in how the target actually behaves. Judge enrichment is also critical — hunt is designed to find subtle violations, and agents that retrieve unauthorized data but return a clean reply are invisible to a judge that only sees the HTTP response.

Proposed solution

Wire telemetry into the hunt pipeline:

• Grounded recon — run curateTracesIfConfigured before the recon phase so the commander/operator have real trace context when forming hypotheses
• Judge enrichment — propagate a trace ID into each operator thread's target requests and fetch the recorded trace before the verifier judges the thread
• Config surface — accept the same telemetry block in HuntConfig / HuntOptions (SDK) that RunConfig already supports

Acceptance criteria

• telemetry block accepted in hunt config (CLI opfor hunt and SDK hunt())
• Grounded attack generation uses real traces during the recon phase
• Trace ID propagated to target per attack thread (header or body field, matching existing propagation config)
• Judge/verifier receives fetched trace spans alongside the response transcript
• No behaviour change when telemetry.provider is "none" or omitted