natsmsg: producer span + bounded, deduped JetStream publish helper

Every service grew the same publish prologue around PublishMsg: a producer span, W3C trace-context injection, a Nats-Msg-Id dedup header, and a bounded pub-ack wait (universally 5s, because reconnect-forever connections buffer publishes client-side and an unbounded wait pins the caller behind an unreachable broker). mirror-pipeline has it as internal/natspub, entire-api carries three copies of the timeout, entiredb three copies of the header carrier. Publisher owns that prologue and nothing else; StartProducerSpan is the publish-side counterpart of StartConsumerSpan for callers composing by hand.