[APMSVLS-469] feat(traces): rescue errored traces via agent-side error sampler - #1320

Errored traces were only rescued from a drop decision when the root span
itself carried the error, so a trace whose failure happened deeper (for
example a failed downstream call that the handler caught) was still
dropped. Now an error anywhere in the trace makes it a rescue candidate,
matching the Datadog Agent.

🤖

Traces dropped on purpose, either by a tracer sampling rule or by an
explicit MANUAL_DROP, were being fed to the error sampler and could be
sent to Datadog anyway when they contained an error. Only traces dropped
by automatic sampling are now rescue candidates, matching the Datadog
Agent.

🤖

The error sampler's per-signature rate limits were keyed on the
extension's own DD_ENV, so when that was unset every trace shared one
empty env and distinct services competed for the same budget. The env
the tracer reported with the trace is now used instead, matching the
Datadog Agent.

🤖

A panic while the error sampler's lock was held poisoned the mutex,
which silently disabled error-trace rescue for the rest of the sandbox's
life. Recover through poisoning instead: the sampler holds only
rolling-window counters, so a partially updated bucket costs far less
than losing the feature entirely.

🤖

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

The disabled check re-derived "sampler is off" from apm_error_tps at the
call site, a second definition of a condition the sampler already knows.
It now asks the sampler via the new is_disabled(), hoisted above the
payload loop so it costs one lock per flush instead of a check per chunk.

Repins the four serverless-components deps to pick up is_disabled(),
which also brings in non-finite client sample rate handling.

🤖

Replace apm_error_tps and apm_extra_sample_rate with a single
apm_error_sampler_enabled toggle (DD_APM_ERROR_SAMPLER_ENABLED).

Both replaced knobs were introduced earlier on this branch and never
released, so there is no compatibility constraint. Neither carries its
advertised meaning in AlwaysKeep mode: extra_sample_rate is ignored
outright, and error_tps degrades to an on/off switch, so
DD_APM_ERROR_TPS=25 and =1 behave identically. Exposing a rate cap that
is not enforced is worse than not exposing one. Both return, with their
real semantics, when RateLimited is wired up.

Default false while the feature rolls out as opt-in; the plan is to flip
it once it has soaked. AlwaysKeep derives its disabled flag from
target_tps <= 0.0, so the boolean maps onto 1.0 / 0.0 and the disabled
path short-circuits before any SpanView is built.

Refs APMSVLS-469

Build the shipped error sampler (AlwaysKeep, enabled by
apm_error_sampler_enabled) in one place so tests exercise the same
configuration that ships, and cover the disabled default with a test.

A failed clock read no longer aborts the extension, and the clock is only
read when error rescue is enabled. In AlwaysKeep mode the sampler ignores
span contents, so only the root span view is built instead of one per
span.

🤖

The float_cmp allow no longer matches any comparison in the test module
and would mask a real one.

🤖

Condense the doc and inline comments added with the error sampler: drop
roadmap notes, references to prior behavior, and comments that restate
the code they sit above.

🤖