Track existing instrumentation locking risks and lifecycle-safe fixes

Goal

Run the locking guidance introduced in #19998 against the entire open-telemetry/opentelemetry-java-instrumentation repository, including javaagent, library, bootstrap, tooling, and supporting modules.

This issue tracks the repository-wide audit and the lifecycle-safe fixes that follow from it. The audit should not be limited to open pull requests, previously reported paths, or obvious synchronized declarations.

Review scope

Inspect synchronization, atomic state, callbacks, asynchronous handoffs, lifecycle transitions, class loading, initialization, cleanup, and instrumentation state ownership throughout the repository.

For each relevant path, establish:

• which component owns the state and lock;
• whether the supported lifecycle permits concurrent, reentrant, cancelled, retried, or asynchronous execution;
• whether state publication and completion are coordinated correctly;
• whether locks are held across original library calls, instrumenter or SDK calls, callbacks, logging, I/O, waits, scope operations, resource cleanup, class loading, or reflection;
• whether external effects can be moved outside a short state transition without changing ordering or API behavior;
• whether VirtualField, immutable publication, thread confinement, or a once-claim provides the appropriate ownership model.

Do not replace synchronization mechanically. Preserve ordering, exactly-once completion, failure behavior, reentrancy, resource cleanup, class-loader behavior, and the lifecycle contract of each instrumented library.

Expected result

Produce a complete repository-wide inventory of substantive locking and lifecycle risks. For each confirmed issue, document the affected path, supported execution scenario, violated guarantee, and lifecycle-safe remediation.

Add focused coverage for fixes where the relevant behavior can be tested reliably. Paths that are examined and found safe should not be changed merely to standardize synchronization.

Constraints

This is a source-level audit; a reproduced deadlock is not required. Do not report formatting, compilation, or purely hypothetical races. Keep fixes narrowly scoped and track larger design work separately when the correct lifecycle model requires it.