[Story]: Raw OTLP archive on the collector — S3 exporter plus one generic replay job

Parent epic: ADORSYS-GIS/lightbridge-authz#581

### Story Statement

As the platform owner, every authenticated telemetry batch is archived as verbatim raw OTLP in object storage by the collector itself — and one generic replay job can re-feed any slice of it through the real ingest path, so promoting a field to a column comes with historical backfill, for every source, forever.

### Real Intent

The promote-when-useful loop (allowlisted tail → typed column) needs replayability to be loss-free. The observability stores cannot be that archive: Mimir strips/aggregates exactly the high-cardinality per-user attributes promotion wants, and Tempo/Loki hold payloads under short observability retention with no first-class re-emit path. The archive leg therefore lives on the edge collector as a third exporter — no new tool, one more sink in the same YAML.

### Background and Context

Design settled in conversation on 2026-08-31 (recorded here as source of truth): everyone writes to the authenticated OTEL collector; the collector fans out at the edge to (1) Alloy → Mimir/Loki/Tempo (observability copy, short retention), (2) the authz-usage ingest (governed store), (3) an S3-compatible object-storage exporter (raw OTLP archive, partitioned by source/date). opentelemetry-collector-contrib ships an AWS-S3 exporter; the deployed collector image is already contrib (needed for `oidcauthextension`). The estate already runs S3-compatible object storage (Hetzner).

### Source of truth (links)

ADR-0027 · ADORSYS-GIS/lightbridge-authz#581 · ADORSYS-GIS/lightbridge-authz#585 · governance ADR-0014 · `charts/lightbridge-governance/templates/otelcollector-ai-cli.yaml` (the collector this extends)

### Acceptance Criteria

1. The edge collector's pipelines gain an object-storage exporter writing verbatim OTLP (proto or OTLP-JSON) batches, prefixed by trusted source + date; the archive leg sits on the **edge** collector, after authentication and source-stamping, in parallel with — not behind — the Alloy leg, so the governed/archive path does not share fate with the observability pipeline.
2. A single generic replay job (source-agnostic: no per-vendor code) reads an archive prefix/date range and POSTs it through the real authenticated ingest endpoint; grain-table dedup keys make any replay idempotent — a re-run changes no counts (test proves it).
3. A promotion rehearsal is demonstrated end to end: add a nullable column, replay a historical window, the column backfills; counts unchanged.
4. Archive lifecycle/retention is explicit and recorded with rationale, including the PII posture (the archive contains identity attributes; its retention and access control are decided, not defaulted).
5. Exporter failure handling is decided and recorded: the archive leg's queue/retry behavior, and whether archive-sink failure may ever block the governed-store leg (recommendation: no — legs are independent; a dropped archive batch alarms, it does not stop billing ingest).

### Out of Scope

Historical Copilot data (never transited the collector — ADORSYS-GIS/lightbridge-authz#588's one-time governance-ctl S3-NDJSON backfill is the only source for it); replaying **from** Mimir/Loki/Tempo (rejected: lossy/short-retention/bespoke-extraction); any per-tool archive code (retired after ADORSYS-GIS/lightbridge-authz#588's cutover).

### Dependencies and Blockers

ADORSYS-GIS/lightbridge-authz#585 (the authenticated collector path this hangs off); the collector chart currently ships `enabled: false` — enabling it is part of the ADORSYS-GIS/lightbridge-authz#585/governance#84 chain.

### Assumptions

The contrib S3 exporter's output format is readable back by the replay job without loss (verify proto round-trip early — this is the one assumption that would force a format choice).

### Implementation Notes

Collector config lives in `charts/lightbridge-governance` (collectors stay in the governance repo per ADR-0014); the replay job naturally lives beside the usage service it feeds. Bucket prefix layout: `///

/…` so a promotion backfill for one source/window is a cheap prefix read.

### Test Expectations

Round-trip test (archive → replay → identical grain rows); idempotent re-replay test; a rehearsed promotion backfill in CI or a documented runbook run.

### Verification evidence

To be attached on the implementing PR: bucket listing sample, replay run log with before/after counts.

### Human accountable owner

Stephane Segning Lambou

### AI Usage

AI-assisted (Claude): research and drafting. Reviewed and owned by Stephane Segning Lambou.