Adds Prometheus metrics so the supervisor's outbound HTTP calls are observable - including client-side failures that previously only surfaced as a log line.

• supervisor_outbound_request_total{name, method, status, outcome} - counts every outbound request. outcome separates a transport failure (network_error), an HTTP error response (http_error), a response that failed schema validation (invalid_response), and success (ok).
• supervisor_outbound_request_duration_seconds{name, outcome} - latency histogram. Leaner labels than the counter (no status) to avoid bucket×label cardinality; buckets match the existing dequeue-latency histogram since these calls share the same retrying HTTP client and long-poll envelope.

Coverage:

• The warm-start request (a one-off fetch) - instrumented inline; the response status code is now also included in the failure log (it was previously dropped).
• All worker API client calls (SupervisorHttpClient: dequeue, run attempt start/complete, heartbeats, snapshots, continue, suspend, debug-log, connect) - routed through a single instrumented request() helper that reports via an optional onHttpRequestComplete callback on the client, which the supervisor wires into the counter + histogram.

Low cardinality by design: name is a static per-endpoint label (e.g. dequeue, start_run_attempt), never the interpolated URL - so no run/snapshot IDs land in labels, mirroring the templated route labels on the inbound HTTP server.

Registered on the existing metrics registry, exposed on /metrics with no new wiring. Internal-only change (no package release needed), so the changelog note is a single .server-changes entry.