Collector upgrade

Steps

1. Choose the target under the pin policy of plan section 5 (a minor line younger than 30 days is skipped unless a security fix needs it) and record it there with a one-line reason.
2. Move every pin of the collector together:
   • collector/builder-config.yaml: every gomod line of go.opentelemetry.io/collector/... and github.com/open-telemetry/opentelemetry-collector-contrib/....
   • go.mod: the go.opentelemetry.io/collector/... requirements (the custom components live in the root module, which the generated module replaces, so the root go.mod takes part in version selection). Then go mod tidy.
   • Makefile: OCB_VERSION.
   • deploy/images/collector.Dockerfile: the otel/opentelemetry-collector-builder tag and index digest, resolved with docker buildx imagetools inspect. Check that image’s Go version against go.mod; for 0.165.0 it shipped Go 1.27.3, which is why the Dockerfile copies ocb into the pinned Go image.
3. Read the upstream changelogs for every version passed, for the receiver limits, the transform and memory_limiter processors, the confmap providers and any rename of telemetry metrics (the alerts read otelcol_receiver_accepted_metric_points and friends, ../reference/observability.md).
4. Build:
   make collector-build
   
   Expected: ocb logs Compiled {"binary": "./dist/scf-otelcol/scf-otelcol"} and the target ends with ./dist/scf-otelcol/scf-otelcol components >/dev/null exiting 0. A strict-versioning failure names the module that resolved to another version.
5. Run the gates:
   make collector-it      # the binary against real NATS with the production permissions
   make apipath           # the four example apps through edge Caddy into PostgreSQL
   make test
   
   collector-it must end with ok github.com/justmert/veristar/tests/collector. Also run promtool rule tests if a telemetry metric name changed (infra/ansible/roles/observability/files/rules/tests/).
6. Release and roll out as any image change: tag, release-images.yml, then make staging-deploy ROLLING=1 SA_IMAGE_TAG=<release> SA_RELEASE_MANIFEST=<release-images.json>. Edge nodes are updated one at a time behind the drain, so OTLP clients move to the other nodes while one restarts. Check IngestOTLPErrorRatioHigh stays quiet and API_METRICS drains.
7. Rollback is a redeploy of the previous release tag; the collector keeps no state of its own (tokens come from the registry_otlp bucket, data goes to API_METRICS).

Exercised