Audit telemetry properties for dot-namespace grouping

[EhabY]

Context

Came up while reviewing #948. We dot-namespace event names (auth.unauthorized_intercepted, workspace.state_transitioned) but property keys are flat camelCase. For events whose properties share a real sub-concept, flattening produces compound names (fromStatus, fromLifecycleState) and forfeits prefix-grep on the group.

Convention

Derived from OpenTelemetry's attribute naming spec and the span attribute guide:

1. General-to-specific dot-namespacing: {dimension}.{aspect}, mirroring OTel's {domain}.{component}.{property}. So status.from, not from.status (parallel to http.request.method, not request.method.http).
2. When to apply: a property group with 3+ siblings, or 2 siblings expected to grow, all sharing a real sub-concept (a dimension, a metric family, an entity).
3. Otherwise stay flat: single-property or atomic-record events keep bare/camelCase names.
4. Hard constraint (OTel): a name cannot be both an attribute and a namespace prefix. Never both status and status.from.

Scope

Rename

workspace.agent.state_transitioned (two state dimensions, qualified)

• fromStatus/toStatus → status.from/status.to
• fromLifecycleState/toLifecycleState → lifecycleState.from/lifecycleState.to

http.requests (two metric families)

• count_{1xx,2xx,3xx,4xx,5xx,network_error} → count.{1xx,2xx,3xx,4xx,5xx,network_error}
• p{50,95,99}_duration_ms → duration.p{50,95,99}_ms
• Decide: keep snake_case within keys (status-code classes and percentile names don't camelCase naturally) or normalize.

Leave as-is

• workspace.state_transitioned: single dimension, bare from/to already correct.
• connection.state_transitioned: same.
• All 24 atomic / single-property events (auth.token_refreshed, ssh.process.discovered, connection.opened, etc.).

Optional clarity tweak

In workspace.state_transitioned, transition (build kind: start/stop/delete) reads ambiguously next to from/to (state-transition direction). Rename to buildTransition/buildReason for disambiguation. Only two siblings so no dot-namespace.

Design note

Inline at the workspace.agent.state_transitioned emit site in src/instrumentation/workspace.ts. Refresh when this lands.