agent component hardcodes a Python command for OTel auto-instrumentation

> _Migrated from https://github.com/aws-samples/sample-open-agentic-platform/issues/50 — originally opened by @shapirov103 on 2026-08-08T05:14:23Z._

## Problem

The `agent` ComponentDefinition overrides the container command to enable OpenTelemetry auto-instrumentation:

```cue
// gitops/addons/charts/oam-agent-components/templates/agent.yaml (~line 96)
if parameter.observability.mode == "decentralized" {
command: ["opentelemetry-instrument", "python", "-m", "app.main"]
}
```

A platform-level ComponentDefinition should not know how a workload starts. This line hardcodes three image-specific facts:

1. **The runtime is Python.** A Node, Go, or Java agent gets `python: not found` and CrashLoops.
2. **The module path is `app.main`.** A Python agent with a different entrypoint also breaks.
3. **`opentelemetry-instrument` is on `PATH`**, which only holds because `strands-agent-base` depends on `aws-opentelemetry-distro` (`applications/strands-agent-base/pyproject.toml`).

So `observability.mode: decentralized` is only usable by one specific image, even though `agent` is a general-purpose component type.

### Secondary problem: duplicated entrypoint drifts

`applications/strands-agent-base/Dockerfile` already declares:

```dockerfile
CMD ["python", "-m", "app.main"]
```

The definition restates that command with a prefix, so the entrypoint now lives in two places. If the image changes how it starts, the component keeps overriding it with a stale command and nothing fails at render time. The pod just runs the wrong thing.

### Related: this block exists only in generated output

`platform/oam/definitions/components/agent.cue` does **not** contain the `command` block; it was hand-edited into the generated `agent.yaml`. Because `platform/oam/generate.sh` renders `agent.yaml` from `agent.cue`, **anyone who runs `generate.sh` today silently deletes it** and breaks decentralized-observability tracing with no error. This was hit and worked around while doing unrelated work (the regenerated file had to be reverted by hand).

Note that `agent.cue` also sets `OTEL_PYTHON_DISTRO` and `OTEL_PYTHON_CONFIGURATOR`. Those are lower severity, since other runtimes ignore unrecognized `OTEL_PYTHON_*` variables, so they are noise rather than breakage. The `command` override is the part that actually fails.

## Proposed fix

Auto-instrumentation is an **image** concern. The platform should declare *that* observability is enabled and *where* to export; how a given runtime instruments itself belongs to that runtime's image.

**Preferred: the image self-wraps.** The definition already sets `AGENT_OBSERVABILITY_ENABLED=true` in decentralized mode, so the signal exists. Add an entrypoint script to `strands-agent-base` that reads it:

```sh
#!/bin/sh
if [ "$AGENT_OBSERVABILITY_ENABLED" = "true" ]; then
exec opentelemetry-instrument python -m app.main
fi
exec python -m app.main
```

Then delete the `command` override from the definition. Each image decides for its own runtime, and the entrypoint lives in exactly one place.

**Alternative: always instrument, disable by config.** Bake `opentelemetry-instrument` into the image's `CMD` unconditionally and use the OpenTelemetry standard `OTEL_SDK_DISABLED=true` to turn it off. No conditional logic anywhere, and it is spec-defined rather than bespoke. This changes behavior when observability is off, so it needs a deliberate decision.

## Acceptance criteria

- [ ] `agent` ComponentDefinition sets no `command`, so any image can be used with `observability.mode: decentralized`
- [ ] `strands-agent-base` enables auto-instrumentation itself, driven by env
- [ ] Agent image rebuilt and published
- [ ] Traces still arrive for a decentralized-mode agent after the change (verify end to end, not just that the pod starts)
- [ ] `./generate.sh` produces no diff against the committed `agent.yaml`, closing the regeneration hazard
- [ ] Consider whether `OTEL_PYTHON_DISTRO` / `OTEL_PYTHON_CONFIGURATOR` should also move into the image

## Coordination note

Decentralized observability currently works **because of** this line. Removing it from the definition and adding the image entrypoint must ship together with a rebuilt image, otherwise traces stop. Sequence the image release first, then the definition change.

Start with platform/oam/definitions/components/agent.cue, the generated gitops/addons/charts/oam-agent-components/templates/agent.yaml, and applications/strands-agent-base/Dockerfile; inspect ./generate.sh to understand the regeneration path. Trace how AGENT_OBSERVABILITY_ENABLED and the image entrypoint control instrumentation, then verify the rebuilt image and definition together. Done means generation produces no diff, decentralized agents start with supported images, and traces arrive end to end.

Written by the indexing model from the issue text.