Add fail-closed AgentLoop SLS trace query smoke

[shenjiecode]

Scope

Add an opt-in, read-only AgentLoop trace query helper backed by the official Alibaba Cloud SLS Python SDK. Credentials must come only from a repository-external private file selected by TIANGONG_AGENTLOOP_QUERY_SECRET_FILE.

Acceptance

• default path does not run cloud queries
• missing/unsafe credential file fails closed
• query output is bounded and never prints credential values or raw span content
• service and expected Work/Task IDs are explicit inputs
• deterministic contract tests require no cloud credential

This is diagnostics only and does not affect Tiangong authority, completion, authorization, or recovery.