docs(plans): record step 2's MR and widen its Files list

What this does

Two edits to docs/plans/2026-08-28-npm-remote-observability.md, both step 2's bookkeeping.

The Status table row. Step 2 opened as !2187 (merged), so its row gets the reference. One line.

Step 2's Files and Tests entries. !2187 (merged) touches two files those entries do not name, and both are forced by the retirement rather than picked up alongside it, so the entries were incomplete rather than the MR out of scope:

• internal/format/npm/packument.go carries a //nolint:goconst on fullVersionFields whose justification names fieldKeyVersion as the constant match-constant matched. That constant is the one step 2 deletes, so left alone the directive would cite a symbol its own MR removed.
• internal/format/npm/remote_metrics_test.go carries the high-cardinality guard, which tells every forbidden label that it "belongs on the npm_remote_proxy wide event". version is in that list and stops being a field of the event, so the message goes wrong for one of its own labels unless it widens. version stays forbidden: no metric should carry it.

The remote_observe.go bullet loses its "correct the emitter's doc, which counts six omitted fields" clause with them. There is no six-count there to correct: step 1b (!2076 (merged)) had already replaced that prose with a form naming no number, and the surviving six-count is the docs/dev/observability.md row the next bullet already covers. The bullet now names the attribute-slice capacity, which is the number step 2 does re-derive.

Step 1's cross-reference to that clause. Step 1's remote_observe.go bullet explains why its third comment site is not covered by step 2, and does it by naming what step 2 touches there ("step 2 touches this same doc block for its omitted-field count"). Dropping that clause from step 2 left the sentence pointing at an obligation step 2 does not carry, so it now names what step 2 does edit in that file: the struct's coordinate comment and the emitter's attribute-slice capacity. Step 1 has merged (!2075 (merged), !2076 (merged)) and its Files entry is otherwise left as authorized; this corrects the sentence's claim about a sibling step, not what step 1 was asked to do.

Why it is a separate MR

A step MR must not edit the plan file, the Status table included. Parallel step MRs editing their own rows collide wherever those rows are adjacent lines of the same file, and this plan keeps consecutive steps in flight together. The table gets a single writer instead, which is this MR. The Files widening rides here for the same reason, and keeping both in one MR keeps two open MRs off the same plan file.

An empty cell in that table means "not yet recorded", not "not started". Row 4 stays empty on purpose: that step has not opened an MR.

This title deliberately carries no plan marker. Only the step's own MR carries (S15 observability plan: 2/5), so that a search on the marker finds exactly one MR per step.

Maintenance, so no issue link is owed.