fix(tracer): improve error handling for subprocess instrumentation [backport 3.9]

[github-actions]

Backport cb08856 from #13625 to 3.9.

This PR improves error handling for subprocess instrumentation. This PR fixes #13208

Restructured error handling: Moved subprocess calls outside of try-except blocks so legitimate errors are properly propagated:

# After (CORRECT - preserves errors)
@trace_utils.with_traced_module  
def _traced_subprocess_init(module, pin, wrapped, instance, args, kwargs):
    if not should_instrument:
        return wrapped(*args, **kwargs)
    
    try:
        # Only tracing logic in try-catch, not the subprocess call
        # ... instrumentation code ...
    except Exception:
        log.debug("Could not trace subprocess execution", exc_info=True)
    
    return wrapped(*args, **kwargs)  # ← Always called, errors propagate correctly

• Insufficient error handling tests: Limited coverage of error conditions across different subprocess and os functions
• Parameterized tests across different configuration scenarios:
  • ASM enabled/disabled combinations
  • IAST enabled/disabled combinations
  • WAF bypass configurations

Checklist

• PR author has checked that all the criteria below are met
• The PR description includes an overview of the change
• The PR description articulates the motivation for the change
• The change includes tests OR the PR description describes a testing strategy
• The PR description notes risks associated with the change, if any
• Newly-added code is easy to change
• The change follows the library release note guidelines
• The change includes or references documentation updates if necessary
• Backport labels are set (if applicable)

Reviewer Checklist

• Reviewer has checked that all the criteria below are met
• Title is accurate
• All changes are related to the pull request's stated goal
• Avoids breaking API changes
• Testing strategy adequately addresses listed risks
• Newly-added code is easy to change
• Release note makes sense to a user of the library
• If necessary, author has acknowledged and discussed the performance implications of this PR as reported in the benchmarks PR comment
• Backport labels are set in a manner that is consistent with the release branch maintenance policy

[github-actions]

CODEOWNERS have been resolved as:

releasenotes/notes/fix-subprocess-error-c90edf09a8ca57f3.yaml           @DataDog/apm-python
ddtrace/contrib/internal/subprocess/patch.py                            @DataDog/asm-python
ddtrace/settings/asm.py                                                 @DataDog/asm-python
tests/contrib/subprocess/test_subprocess.py                             @DataDog/asm-python

[github-actions]

Bootstrap import analysis

Comparison of import times between this PR and base.

Summary

The average import time from this PR is: 274 ± 3 ms.

The average import time from base is: 279 ± 4 ms.

The import time difference between this PR and base is: -5.4 ± 0.1 ms.

Import time breakdown

The following import paths have shrunk:

ddtrace.auto 2.770 ms (1.01%)

ddtrace.bootstrap.sitecustomize 2.031 ms (0.74%)

ddtrace.bootstrap.preload 1.569 ms (0.57%)

ddtrace.internal.remoteconfig.client 0.710 ms (0.26%)

ddtrace.appsec._common_module_patches 0.144 ms (0.05%)

ddtrace.appsec._asm_request_context 0.144 ms (0.05%)

ddtrace._trace.trace_handlers 0.118 ms (0.04%)

ddtrace._trace._inferred_proxy 0.066 ms (0.02%)

ddtrace.propagation.http 0.066 ms (0.02%)

ddtrace 0.739 ms (0.27%)

ddtrace.internal._unpatched 0.089 ms (0.03%)

subprocess 0.056 ms (0.02%)

contextlib 0.056 ms (0.02%)

json 0.033 ms (0.01%)

json.decoder 0.033 ms (0.01%)

re 0.033 ms (0.01%)

enum 0.033 ms (0.01%)

types 0.033 ms (0.01%)

[pr-commenter]

Benchmarks

Benchmark execution time: 2025-06-18 10:10:56

Comparing candidate commit eaff963 in PR branch backport-13625-to-3.9 with baseline commit 82571ae in branch 3.9.

Found 0 performance improvements and 1 performance regressions! Performance is the same for 434 metrics, 3 unstable metrics.

scenario:telemetryaddmetric-1-gauge-metric-1-times

• 🟥 execution_time [+264.699ns; +322.970ns] or [+12.468%; +15.213%]