feat(pilot): emit per-review Langfuse traces

Ship token spend, latency and equivalent cost for every review to the
self-hosted Langfuse so per-model behaviour is queryable as a trend rather
than one PR comment at a time.

langfuse_trace.py is stdlib-only and emits via the public ingestion API.
Traces split into `ollama` and `claude` environments keyed off the bare model
name, not the provider: both paths go through the same headroom proxy, so the
provider prefix says nothing about which spend story a review belongs to. The
pilot's own path bills $0, so the reported cost is the equivalent price from
cost_model.PRICES.

ai_review.py calls _emit_langfuse on both token-spending exit paths (the
normal post and the salvage path). Import and emission are wrapped in a
blanket except: with no LANGFUSE_HOST or key pair the whole thing is a silent
no-op, and a telemetry failure must never fail a review.

These files were previously deployed only by way of the image build's
`COPY . /app`, so a clean checkout would have silently dropped tracing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

README.md

@@ -94,6 +94,11 @@ path is in [`pilot/README.md`](pilot/README.md).
 The model endpoint is supplied at runtime via `PRAGENT_MODEL_BASE_URL`; the
 committed `opencode.json` carries a placeholder.
 
+Per-review token spend, latency and equivalent cost are shipped to a
+self-hosted Langfuse, split into `ollama` and `claude` environments so the two
+spend stories stay separate: [`pilot/README-langfuse.md`](pilot/README-langfuse.md).
+Emission is a silent no-op unless `LANGFUSE_HOST` and the key pair are set.
+
 ## Extending it
 
 The review "factory" is [`.opencode/`](.opencode/README.md) — agent definitions