fix(ci): dedupe @opentelemetry/core past audit advisory; join paths in test

- bun audit failed on GHSA-8988-4f7v-96qf: otlp-transformer 0.213.0 pins
  @opentelemetry/core 2.6.0 (<2.8.0). Override to ^2.10.0, matching the
  version the telemetry sink packages already resolve.
- Build the expected tracesDirectory with path.join so the assertion holds
  on Windows separators.

Author: tejaskash

bun.lock

@@ -76,5 +76,8 @@
     "winston": "^3.19.0",
     "winston-daily-rotate-file": "^5.0.0",
     "zod": "^4.4.3"
+  },
+  "overrides": {
+    "@opentelemetry/core": "^2.10.0"
   }
 }

package.json

@@ -1,4 +1,5 @@
 import { describe, expect, test } from "bun:test";
+import { join } from "node:path";
 import type { ProjectRuntime } from "../../../projectSchemas/runtime";
 import { InputValidationError, ResourceNotFoundError } from "../../../errors";
 import type { PortChecker } from "../../../io";
@@ -182,7 +183,7 @@ describe("project dev trace collection", () => {
 
     expect(subject.collector.starts).toEqual([
       {
-        tracesDirectory: "/workspace/project/agentcore/.cli/traces/otlp",
+        tracesDirectory: join("/workspace/project", "agentcore", ".cli", "traces", "otlp"),
         signal: expect.any(AbortSignal),
       },
     ]);