feat(pilot): emit per-review Langfuse traces

Ship token spend, latency and equivalent cost for every review to the
self-hosted Langfuse so per-model behaviour is queryable as a trend rather
than one PR comment at a time.

langfuse_trace.py is stdlib-only and emits via the public ingestion API.
Traces split into `ollama` and `claude` environments keyed off the bare model
name, not the provider: both paths go through the same headroom proxy, so the
provider prefix says nothing about which spend story a review belongs to. The
pilot's own path bills $0, so the reported cost is the equivalent price from
cost_model.PRICES.

ai_review.py calls _emit_langfuse on both token-spending exit paths (the
normal post and the salvage path). Import and emission are wrapped in a
blanket except: with no LANGFUSE_HOST or key pair the whole thing is a silent
no-op, and a telemetry failure must never fail a review.

These files were previously deployed only by way of the image build's
`COPY . /app`, so a clean checkout would have silently dropped tracing.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

pilot/ai_review.py

@@ -2068,6 +2068,49 @@ def _need(name: str) -> str:
     return v
 
 
+def _emit_langfuse(
+    *,
+    repo: str,
+    index: str,
+    sha: str,
+    title: str,
+    model: str,
+    usage: dict | None,
+    findings: list[dict],
+    summary: str,
+    engine: str,
+    config: dict | None = None,
+) -> None:
+    """Ship this review's usage to Langfuse, if one is configured.
+
+    Called on both exit paths that spent tokens — the normal post and the
+    salvage path — because an unparseable run costs the same as a clean one and
+    is exactly the kind of thing worth trending.
+
+    Local import + blanket except: `langfuse_trace` is stdlib-only but optional,
+    and telemetry is never allowed to fail a review (see the fail-open contract
+    in `review_pr`). The trace's `environment` is `claude` or `ollama`, so the
+    two spend stories stay separated in every Langfuse view.
+    """
+    try:
+        import langfuse_trace
+
+        # Same comparison model the review body prices against, so the number
+        # in Langfuse and the number in the PR agree. Free/unknown models
+        # (MiniMax, glm, self-hosted qwen) are priced against it; a paid model
+        # is priced as itself.
+        price_target, _err = _resolve_price_target(config)
+
+        langfuse_trace.emit_review_trace(
+            repo=repo, index=index, sha=sha, title=title, model=model,
+            usage=usage, findings=findings, summary=summary or "",
+            engine=engine, lenses=(usage or {}).get("lenses"),
+            price_target=price_target,
+        )
+    except Exception as e:
+        print(f"pragent: langfuse emit skipped: {e}", file=sys.stderr)
+
+
 def review_pr(
     api: str,
     repo: str,
@@ -2208,6 +2251,11 @@ def review_pr(
                     salvaged or "AI review produced no parseable output.",
                     display_model, sha, usage_section=usage_section,
                     static_message=(config or {}).get("static_message", "")))
+                _emit_langfuse(
+                    repo=repo, index=index, sha=sha, title=title,
+                    model=display_model, usage=usage, findings=[],
+                    summary=salvaged, engine=engine, config=config,
+                )
                 return True
         else:
             user_prompt = build_user_prompt(title, body + compression_note, diff, config, prior, additional_context)
@@ -2291,6 +2339,11 @@ def review_pr(
         )
 
         post_inline_review(api, repo, index, token, summary_body, anchored)
+        _emit_langfuse(
+            repo=repo, index=index, sha=sha, title=title,
+            model=display_model, usage=usage, findings=findings,
+            summary=review_summary, engine=engine, config=config,
+        )
         print(
             f"pragent: reviewed {repo}#{index} sha={sha[:8]} "
             f"engine={engine} findings={len(findings)} inline={len(anchored)}",