chore(tracing): drop the root SDK copy, ship the vendored submodule in images

[pablovilas]

Follow-up to #215.

• Removes the root nptrace.sh, a second copy of the tracing shell SDK that already drifted from the vendor/catalog-tracing-sh submodule.
• k8s/logging / scheduled_task/logging load the SDK only from the submodule and keep the loud warning when it is missing.
• publish-images.yml checks the submodule out for the three image builds, so the images carry the SDK instead of relying on the root copy.

What happens if the submodule is missing

Nothing breaks. The workflow scripts run as plain logging:

• k8s/logging sources the SDK only when vendor/catalog-tracing-sh/nptrace.sh exists. Without it nothing is sourced and no ERR/EXIT traps are installed.

• Every np_scope_* helper starts with command -v np_trace_… >/dev/null || return 0, and log error calls _np_scopes_trace_error … || true, which returns 0 as soon as there is no np_trace_adopt. Every call site is a successful no-op.

• The only visible difference is one line, emitted once when the run is traced (NP_TRACE and NP_API_KEY set) but the SDK is absent:

  ⚠️  tracing SDK not bundled (vendor/catalog-tracing-sh/nptrace.sh missing) — scope-side tracing disabled for this run
  

  Today the root copy silently covers a missing submodule, so this warning never fires. After this PR an image built without the submodule still works but says so in the workflow log, and the scope's trace shows only the orchestrator's stations without the step detail.

Covered by k8s/utils/tests/trace_logging.bats: "without NP_TRACE / without NP_API_KEY, logging is byte-identical to plain logging" and "a traced run with credentials but NO bundled SDK warns loudly instead of degrading silently".

Merge order

Depends on nullplatform/actions-nullplatform#99 (the reusable workflow gains a submodules input). Merge that first: until it lands, the reusable workflow rejects the unknown submodules input and a tag push would fail the image build.