[claude_cowork] ECS GenAI Field Support for detections

**Related issue:**
- https://github.com/elastic/integrations/issues/20737

TRaDE is requesting that the following fields be added to this integration for security detections:

## Requested fields
| Field | Availability | Status |
|---|---|---|
| `gen_ai.operation.name` | ✅ `attributes.query_source` in `api_request` events (e.g., `"sdk"`) | ⚠️ Semantically mismatched — `query_source` describes the internal invocation source, not the LLM operation type; ECS/OTel expects values like `"chat"` or `"text_completion"` |
| `gen_ai.conversation.id` (OTel) | ✅ `attributes.session.id` (UUID) emitted on all event types representing an agentic session | ❌ Not implemented — stored as `claude_cowork.events.session.id` and not mapped to `gen_ai.conversation.id` |
| `gen_ai.usage.input_tokens` | ✅ `attributes.input_tokens` in `api_request` events | ✅ Implemented |
| `gen_ai.usage.output_tokens` | ✅ `attributes.output_tokens` in `api_request` events | ✅ Implemented |
| `gen_ai.input.messages` | ⚠️ User prompt text is captured in `user_prompt` events (optionally) per the README, but no raw API body gate is documented for Cowork; full conversation message arrays are not logged | ❌ Not implemented |
| `gen_ai.response.id` | ✅ `attributes.request_id` in `api_request` events (Anthropic `req_*` identifier) | ✅ Implemented |
| `gen_ai.tool.call.id` | ✅ `attributes.tool_use_id` in `tool_result` and `tool_decision` events | ✅ Implemented |
| `gen_ai.tool.name` | ✅ `attributes.tool_name` for native tools; `attributes.mcp_tool.name` emitted as a direct structured attribute for MCP tools (unlike `claude_code` which had to parse it from a JSON blob) | ✅ Implemented |

## Likely already implemented (verify on development)
| Field | Availability | Status |
|---|---|---|
| `gen_ai.provider.name` | ✅ Hardcoded as `"anthropic"` | ✅ Implemented — defined as `constant_keyword` with value `"anthropic"` |
| `gen_ai.request.model` | ✅ `attributes.model` in `api_request` events (e.g., `"claude-opus-4-8"`) | ✅ Implemented — copied from `gen_ai.response.model` |
| `gen_ai.response.model` | ✅ `attributes.model` in `api_request` events | ✅ Implemented — request and response model are always identical |

## Likely not possible (verify on development)
| Field | Availability | Status |
|---|---|---|
| `gen_ai.request.max_tokens` | ❌ Not emitted by Cowork runtime; request parameters are not included in telemetry | ❌ Not implemented |
| `gen_ai.request.temperature` | ❌ Not emitted by Cowork runtime | ❌ Not implemented |
| `gen_ai.request.seed` | ❌ Not emitted by Cowork runtime | ❌ Not implemented |
| `gen_ai.request.stop_sequences` | ❌ Not emitted by Cowork runtime | ❌ Not implemented |
| `gen_ai.token.type` | ❌ Not a discrete field in Cowork telemetry | ❌ Not implemented |
| `gen_ai.response.finish_reasons` | ❌ Stop reason is not emitted by the Cowork runtime | ❌ Not implemented |
| `gen_ai.output.type` | ❌ Not logged | ❌ Not implemented |
| `gen_ai.output.messages` | ❌ Model response content is not logged in Cowork telemetry; no equivalent to `OTEL_LOG_RAW_API_BODIES` is documented in the Cowork README | ❌ Not implemented |
| `gen_ai.system_instructions` | ❌ Not logged in Cowork telemetry | ❌ Not implemented |
| `gen_ai.tool.definitions` | ❌ Not emitted in Cowork telemetry | ❌ Not implemented |
| `gen_ai.tool.type` | ❌ Not a discrete field; not logged (possibly always `function` or similar?) | ❌ Not implemented |
| `gen_ai.tool.call.result` | ⚠️ Result content is not logged; only `tool_result_size_bytes` is captured | ❌ Not implemented |
| `gen_ai.tool.call.arguments` | ❌ Cowork `tool_result` events do not emit `tool_input` or `tool_parameters` — only size bytes are logged | ❌ Not implemented and not defined in schema (unlike `claude_code` which defined and populated this field) |
| `file.*` | ❌ Not available — Cowork does not include `tool_parameters` with file paths in its telemetry; no extraction is possible | ❌ Not applicable |
| `destination.address` | ❌ Not available — no `tool_parameters` with URL data emitted; no `url.full` extraction in pipeline | ❌ Not applicable |

Start with the related issue 20737 and the Cowork README, then inspect the api_request, user_prompt, tool_result, and tool_decision event mappings. Verify the listed ECS GenAI fields against development telemetry, map the supported fields, and document or confirm the fields unavailable from Cowork telemetry.

Written by the indexing model from the issue text.