feat: export risk findings over OTLP

[tgmendes]

Summary

• Add Risk Findings as a project-scoped data export source and route new findings to configured OTLP log destinations through a dedicated Pub/Sub subscriber.
• Emit a privacy-safe log contract: a generic event body, no raw match or finding description, and a stable finding ID plus policy, rule, source, confidence, and non-secret anchors for filtering and deduplication.
• Re-evaluate project and global exclusions for every relay batch. Excluded findings never leave Gram; lookup failures retry instead of exporting, and newly changed exclusions apply to the next batch without stale cross-batch cache state.
• Expose Risk Findings in the Data exports configuration UI and regenerate the API, SDK, and Pub/Sub artifacts.

Motivation

Risk findings need to reach customer-operated security and observability systems without crossing Gram's privacy boundary. The relay uses the existing authenticated OTLP destination pipeline while treating exclusion state as an export authorization decision: suppression is checked immediately before delivery and fails closed when it cannot be evaluated.

---

Summary by cubic

Adds risk_findings as a project-scoped data export source; routes that previously accepted only product telemetry can now send new findings to configured OTLP log destinations through a dedicated Pub/Sub subscriber.

• Emits privacy-safe logs with a stable finding ID, policy, rule, source, confidence, and non-secret anchors; raw matches and finding descriptions remain excluded.
• Rechecks project and global exclusions for every relay batch, keeping excluded findings in Gram and retrying lookup failures.
• Exposes the source in Data exports and updates the API, SDK, and Pub/Sub artifacts.

^{Written for commit 973ab52. Summary will update on new commits.}

[changeset-bot]

🦋 Changeset detected

Latest commit: 973ab52

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 2 packages

Name	Type
server	Minor
dashboard	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cubic-dev-ai]

Running ultrareview automatically — This PR adds a privacy-sensitive risk-findings export pipeline with new OTLP relay logic, exclusion re-evaluation, and Pub/Sub infrastructure—a subtle bug could leak findings or break data delivery, warranting deep review.. I'll post findings when complete.

[tgmendes]

Demo

What it shows:

1. Start a new project data export.
2. Open the data source selector and choose Risk findings.
3. The form switches to the risk finding OTLP log source and its source-specific description.

[cubic-dev-ai]

Ultrareview completed in 15m 47s

1 issue found across 36 files

_{Heads up: you’re close to your included review allowance. Set a flex budget so reviews don’t pause.}

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="server/internal/otel/handler_risk_finding_relay_test.go">

<violation number="1" location="server/internal/otel/handler_risk_finding_relay_test.go:72">
P2: No test asserts the finding description is absent from the serialized payload, even though excluding it is a core privacy guarantee of this PR. `TestRiskFindingRelayExportsSafeOTLPLog` checks only the raw match, and `TestRiskFindingRelayUsesGenericBody` sets a sensitive description (an email) but checks only that the body is the generic constant. If a future change adds description to the log-record attributes, all tests still pass and the sensitive value leaks. Add a `proto.Marshal` + `require.NotContains(description)` check alongside the existing match check.</violation>
</file>

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[gram-bot]

Auto-approved: review:bypass label applied by @tgmendes. Required status checks still gate this merge.

review:bypass label removed by @tgmendes.