feat: freeze typed metrics registry and bounded exemplars

crates/crank-observability/tests/prometheus.rs

@@ -71,6 +71,18 @@ fn non_loopback_without_a_token_is_rejected_without_secret_data() {
     assert!(!error.to_string().contains("token="));
 }
 
+#[test]
+fn metrics_surface_rejects_an_unregistered_process_identity() {
+    let config = MetricsConfig::new(
+        true,
+        SocketAddr::new(IpAddr::V4(Ipv4Addr::LOCALHOST), 9464),
+        None,
+    )
+    .unwrap();
+    let identity = ServiceIdentity::try_new("user-controlled", "0.3.1", "test").unwrap();
+    assert!(MetricsSurface::for_test(config, identity).is_err());
+}
+
 #[test]
 fn schema_is_closed_and_uses_fixed_duration_buckets() {
     let schema = metric_schema();