feat: add hotpath primitive profiling coverage (#5492)

* chore(deps): refresh google cloud dependencies

Co-Authored-By: heihutu <heihutu@gmail.com>

* feat: add hotpath primitive coverage

Co-Authored-By: heihutu <heihutu@gmail.com>

* feat: extend hotpath profiling features

Co-Authored-By: heihutu <heihutu@gmail.com>

* fix: gate OPA hotpath client wrapping

Co-Authored-By: heihutu <heihutu@gmail.com>

* fix: avoid request-scoped hotpath primitive wrappers

Preserve the original bounded channel and stream semantics in EC and RIO request paths while keeping hotpath CPU profiling as a separate opt-in feature that implies base hotpath instrumentation.

Co-Authored-By: heihutu <heihutu@gmail.com>

---------

Co-authored-by: heihutu <heihutu@gmail.com>

crates/policy/src/policy/opa.rs

@@ -32,10 +32,15 @@ impl Args {
 
 #[derive(Debug, Clone)]
 pub struct AuthZPlugin {
-    client: reqwest::Client,
+    client: OpaHttpClient,
     args: Args,
 }
 
+#[cfg(feature = "hotpath")]
+type OpaHttpClient = hotpath::wrap::reqwest::Client;
+#[cfg(not(feature = "hotpath"))]
+type OpaHttpClient = reqwest::Client;
+
 #[derive(Debug, thiserror::Error)]
 pub enum OpaConfigError {
     #[error("Missing required env var: {0}")]
@@ -141,6 +146,9 @@ impl AuthZPlugin {
                 reqwest::Client::new()
             });
 
+        #[cfg(feature = "hotpath")]
+        let client = hotpath::http!(client, label = "Policy::OPA");
+
         Self { client, args: config }
     }