pub fn fresh_trace_id() -> String
Generate a fresh 16-byte trace id rendered as 32 lowercase hex characters. Uses BLAKE3 over a CSPRNG-friendly seed (spec 71 randomness rule).