Stability checkpoint — CORS W3C trace context headers (MR !199) Pipeline #824 green on main commit e14285d. Includes : SB3 wave 8 (KafkaConfig V2 overlay) + CORS allowlist now includes traceparent / tracestate / baggage so the UI's OTel Web SDK auto-instrumented XHR is no longer rejected at preflight. Regression test : SecurityConfigTest.corsConfigurationSource_includesW3CTraceContextHeaders. See: https://gitlab.com/mirador1/mirador-service/-/pipelines/2479221932