[CTX-0071] feat(devtools): implement wire-trace flag per accepted design (#120)

[Xuepoo]

Summary

Implements the accepted wire-trace design (child of #72) for bitty-devtools: trace start|stop|fetch-chunk gated by argv-presence-only --wire-trace (default off).

Task / RFC / Issue

• Priority: P2
• Area: devtools
• Labels: feat, P2, area:devtools
• Milestone: v0.1.0
• RFC: PX-0326 design proposal recorded under CTX-0066
• Task: CTX-0071
• Review: independent APPROVE recorded as PX-0340 (reviewer ctx-0071-reviewer-musespark, PX-0338 review start)
• Closes feat(devtools): design wire-trace flag (redaction/bounds/no-bypass) #120

Scope

Exactly 4 files (approved blobs unchanged):

File	Blob
src/cli.ts	5bd8b65
src/tracing.ts	9fffe22
tests/cli.test.ts	0feff2e
tests/tracing.test.ts	9899cdc

Behavior

• trace verbs without --wire-trace exit 2; inspect --wire-trace exits 2; --wire-trace=<value> rejected.
• Live-path only: server-enforced debug.trace per call (debug.inspect alone yields ScopeDenied exit 7); never debug.control.
• No-socket exits 6; never mock data.
• Companions: --duration-ms / --max-bytes / --include-input / --trace-id / --offset plus reused --socket / --instance / --json.
• includeInput defaults false with typed redaction, 8 KiB/record cap, 512-char preview, preview==export assert.
• Spool 0600 / dir 0700 with peer re-check; UTF-8 byte bounds (duration default 10000, 1..300000; maxBytes default 524288, 1..4194304; fixed 262144 scalar-boundary chunks with continuation + byte offset); retention server-side, not argv-tunable.
• 15 negative tests N1-N15.

Evidence (qualified)

• bun test: 389 pass / 0 fail, 3123 expects; scoped cli 42 pass, tracing 30 pass.
• tsc --noEmit clean; build clean (dist/cli.js, dist/tracing.js).
• Prettier 3.6.5 check clean; oxlint clean (1 pre-existing inspection.ts unused-PanelId warning); markdownlint-cli2 0 issues; git diff --check clean.
• Tests use benign in-memory/fake transports only. No live interop against production sockets is claimed.
• gitleaks pre-push: 1 generic-api-key finding on synthetic redaction fixture token=sk-live-... in tests/tracing.test.ts:651, asserted redacted (part of approved blob); no repo gitleaks gate; assessed benign.

Docs sync

RFC amendment text comes from CTX-0066 and follows separately — code merge OK; issue closes via merge only if docs tracked (per task description, merge with docs tracked separately, keeping Closes).

Commit hook

Lefthook pre-commit + commitlint commit-msg hooks pass (no bypass, no bunx, no installs).