observability-contract-review

Verify path coverage, not call-site presence. Grep for helper construction sites, then walk every early-exit and exception path asking which catch records it. Filtered catches like `when (ex is not X)` are the most common hole where guard-thrown exceptions escape unrecorded.

A filter like `catch (Exception ex) when (ex is not McpException)` exists to avoid double-recording inner-catch rethrows, but guard exceptions of the filtered type thrown before the inner try escape entirely. The fix is making record methods idempotent, then widening outer catches to record everything.

Add a private `_recorded` flag to the helper so RecordInvocation and RecordError no-op on second call. Inner typed catches record the domain exception first, preserving the meaningful error_type, while the outer catch safely records previously-escaped paths.

ActivityListener is process-global, so tests listening on a shared source name can capture activities from concurrent test classes, breaking assertions like ShouldHaveSingleItem. Serialize those tests in a collection with DisableParallelization set to true.

Require exact set equality with sorted names via ShouldBe, never a Contains-list. Enumerate tool names across all test files and both call styles, since literal greps for CallAsync miss direct CallToolAsync calls and variable-built names.

When the PR's acceptance criterion or review record claims the whole surface emits the contract, pre-existing gaps become in-scope. Flag them MAJOR and require a fix or a tracked follow-up issue, since the claim as written is the acceptance criterion.