Bumps [go.opentelemetry.io/otel/sdk](https://github.com/open-telemetry/opentelemetry-go) from 1.43.0 to 1.45.0.
- [Release notes](https://github.com/open-telemetry/opentelemetry-go/releases)
- [Changelog](https://github.com/open-telemetry/opentelemetry-go/blob/main/CHANGELOG.md)
- [Commits](https://github.com/open-telemetry/opentelemetry-go/compare/v1.43.0...v1.45.0)

---
updated-dependencies:
- dependency-name: go.opentelemetry.io/otel/sdk
  dependency-version: 1.45.0
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

TealCompile matched any 58 character base32 string and kept matching, so the
last one won. compile now reports the salted address after the program hash,
which made the helper return the wrong one of the two, and every test that
funds the address it returns spent from an account it had not funded:
goalLogicSigTest, limitOrderTest and tealAndStatefulTealTest.

It keeps the first match now, which is the program hash it has always
returned. TealCompileSign is unaffected, since compile prints no address when
it is signing, and tealConsensusTest already stops at the first match.

Also add the t.Parallel that TestAuthorizeWithProgram was missing. cmd is the
one tree the paralleltest linter is not excluded from.

docs: clarify reference array offsets for accounts and applications

A program has two account addresses, so goal needs a way to say which one a
transaction is authorized by. --salted picks the salted one; without it, the
form is taken from whichever address the transaction's authorizer already
matches, and failing that the program hash, so that existing uses keep the
address and the behavior they had. That leaves --salted needed only where
nothing else settles it: clerk send -F with no --from and no --signer, where
the program's address becomes the sender.

Reading the form off the authorizer rather than the sender is what makes a
rekeyed account work: --signer names the authorizer, and that is the address
the program has to match.

LogicSigSanityCheck now covers whichever form a transaction uses, so goal
still checks a program before submitting it.

clerk send's -L branch built its transaction without the AuthAddr that -S had
asked for, while the -F branch beside it set one. Both now go through the same
path, so -L no longer silently drops --signer.

scripts/coverpkg.sh decides which packages are instrumented and
.codecov.yml decides which files are counted. The two had nothing in
common: the command line programs, the build and debug tools, the e2e
tree and the test-support packages were dropped from measurement without
being mentioned here, so 158 files and 18,273 lines went quietly
uncounted rather than deliberately excluded.

List them, so the two descriptions of one decision sit together. This
changes no numbers -- Codecov never saw those files -- it only makes the
exclusion legible, and gives the next person something to change when the
measured set changes.

Two measured packages still go uncounted: no test binary links daemon/kmd
or netdeploy/remote/nodecfg, so they produce no coverage data and covdata
has nothing to emit for them. That is 431 lines, all uncovered, worth
0.4pp on the total.

Concurrency is evaluated per workflow run, before the job conditions that
check for /coverage and the commenter, so any comment on the pull request
joined the group and cancelled a run in progress while starting nothing
in its place. Key the group on the run id unless the comment is a request
the authorize job would accept -- including the author check, or anyone
at all could cancel a run by typing /coverage.

Check out the commit resolved during authorization rather than
refs/pull/N/head. That ref moves, so a push while the partitions were
queued could leave them testing different commits from each other and
from the one the upload is attributed to.