@google-cloud/pubsub depends on EOL @opentelemetry/core@^1.30.1, exposing consumers to GHSA-8988-4f7v-96qf

### Summary

`handwritten/pubsub` (`@google-cloud/pubsub` v6.0.0) declares `@opentelemetry/core: ^1.30.1`. The entire OpenTelemetry JS `1.x` line reached end-of-life (~2026-03-17, one year after the 2.0 release), so it will not receive further patches. `GHSA-8988-4f7v-96qf` / `CVE-2026-54285` (unbounded memory allocation in `W3CBaggagePropagator.extract()`) affects **all** `@opentelemetry/core < 2.8.0`, which includes the whole `1.x` line. The fix exists only in `2.8.0+`, and no `1.x` backport will ship because `1.x` is EOL.

Because pubsub caps `@opentelemetry/core` at `<2.0.0`, every downstream application that installs pubsub has the vulnerable package forced into its tree with **no clean remediation** — the only workaround is a manual `resolutions`/override forcing core to `2.8.0+`, which shouldn't be necessary for a maintained Google client library.

### Why this is a trivial, safe bump (not blocked)

- **Node floor is a non-issue.** pubsub already sets `"engines": { "node": ">=22" }`. OTel core 2.x only requires `^18.19.0 || >=20.6.0`, so the 2.x floor is trivially satisfied. (The usual reason libraries stay on core 1.x — preserving Node 14/16 support — does not apply here.)
- **Precedent in this very repo.** `handwritten/spanner` already depends on `@opentelemetry/core: ^2.0.0`. Same monorepo, same Node policy, same release tooling.
- **Minimal API surface.** pubsub's only runtime import from `@opentelemetry/core` is `W3CTraceContextPropagator` (`handwritten/pubsub/src/telemetry-tracing.ts`), which is retained unchanged in core 2.x. `@opentelemetry/sdk-trace-base` is a devDependency only and does not reach consumers.

### Proposed fix

Bump in `handwritten/pubsub/package.json`:

```diff
- "@opentelemetry/core": "^1.30.1",
+ "@opentelemetry/core": "^2.0.0",
```

(`@opentelemetry/api` stays `~1.9.0` — it is exempt from the 2.0 breaking changes.)

### References

- GHSA-8988-4f7v-96qf: https://github.com/open-telemetry/opentelemetry-js/security/advisories/GHSA-8988-4f7v-96qf
- OTel JS SDK 2.0 (Node floor, `api` exemption): https://opentelemetry.io/blog/2025/otel-js-sdk-2-0/
- Sibling precedent: `handwritten/spanner/package.json` (`@opentelemetry/core: ^2.0.0`)

Start with handwritten/pubsub/package.json and compare its OpenTelemetry dependency with handwritten/spanner/package.json. Check handwritten/pubsub/src/telemetry-tracing.ts for the runtime import, then run the package's available validation or tests; done means pubsub no longer constrains consumers to the vulnerable OpenTelemetry 1.x line.

Written by the indexing model from the issue text.