Ensure enterprise Copilot OTel settings override environment variables

Description

Enterprise-managed Copilot OTel settings can currently be overridden by process environment variables in the VS Code Copilot extension. For example, COPILOT_OTEL_ENABLED=false can disable telemetry enabled by managed settings, and OTEL_EXPORTER_OTLP_ENDPOINT can redirect telemetry away from a managed collector.

The Rust Copilot runtime's managed telemetry API already treats managed values as authoritative. The gap is in the VS Code extension resolver: policy-backed values exposed through Configuration.inspect(...).defaultValue are passed into the ordinary setting* inputs, where environment variables have higher precedence.

Expected behavior

Recognized enterprise-managed OTel values take precedence over environment variables for the corresponding fields. Environment variables may continue to supply fields omitted by policy where that is the intended contract.

At minimum, managed values should govern:

• enablement
• exporter type and output destination
• OTLP endpoint and protocol
• content capture
• service name
• resource attributes and headers on key collisions

Actual behavior

The current resolver permits environment variables to disable, redirect, or alter managed OTel configuration. microsoft/vscode#336701 documents this as an accepted gap while fixing the separate late-policy initialization race.

Suggested fix

Preserve policy provenance when resolving the policy-backed defaults, and pass recognized managed values through the existing policy* inputs to resolveOTelConfig instead of treating them as ordinary settings. Add regression coverage for managed-over-environment precedence, including endpoint redirection and file-export diversion.

Created from a Slack conversation.

Start in the VS Code Copilot extension resolver, tracing Configuration.inspect(...).defaultValue into resolveOTelConfig and its existing policy* inputs. Preserve managed-value provenance and add regression coverage for managed-over-environment precedence, including endpoint redirection and file-export diversion.