v0.22.0

### Added

- **OpenTelemetry / OTLP distributed tracing — `[observability.otlp]`** (P1
  "Observability completeness"; second sub-item of the theme). Export
  per-call traces over OTLP/gRPC to a collector (Tempo / Jaeger / an
  OpenTelemetry Collector). Each call is **one trace** — `on_invite →
  on_matched → accept_inbound → run → { WS bridge, media }` — with the SIP
  `Call-ID`, direction, and from/to on the root span, so an operator can see
  where a call spent its time across the daemon. Config knobs: `endpoint`
  (default `http://localhost:4317`), parent-based `sample_ratio`,
  `timeout_ms`, `service_name`, and extra resource `attributes`; independent
  of the metrics HTTP listener (traces without metrics scraping is a valid
  setup). **Off by default** and **best-effort** (CLAUDE.md §4.7): spans batch
  on a background worker and drop on overflow, so a slow or unreachable
  collector never blocks a call; a bad endpoint fails loud at startup, a
  collector that's merely down does not. When disabled the tracing layer is a
  zero-cost no-op. Pending spans flush on shutdown. See `docs/CONFIG.md` →
  `[observability.otlp]`. W3C trace-context propagation to the WS server is a
  follow-up (v0.23.0).

---

**Artifacts**

- Static musl binaries for `x86_64` and `aarch64` (`.tar.gz`).
- Debian packages (`.deb`) for `amd64` and `arm64` — `apt install ./siphon-ai_*_amd64.deb`.
- `SHA256SUMS` — verify with `sha256sum -c SHA256SUMS`.
- `*-sbom.cdx.json` — CycloneDX SBOM.
- `SHA256SUMS.cosign.bundle` — cosign keyless signature over the checksums.
- Container: `ghcr.io/thevoiceguy/siphon-ai:v0.22.0` (multi-arch, cosign-signed).

Verify the checksums signature:
```
cosign verify-blob --bundle SHA256SUMS.cosign.bundle \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity-regexp 'release.yml@' SHA256SUMS
```