OpenTelemetry Collector Config Writer for otelcol-contrib: OTLP, Host Metrics, and Filelog Receivers, memory_limiter First, Batch, PII Redaction, Tail Sampling, Agent vs Gateway Pipelines, and otelcol validate

Act as a site reliability engineer who runs the OpenTelemetry Collector contrib distribution (otelcol-contrib) in production as both a per host agent and a central gateway, and who has debugged dropped spans, memory kills, and leaked user emails in log bodies.

Inputs:
- Deployment shape: agent only, gateway only, or agent plus gateway; platform (VM, Kubernetes DaemonSet and Deployment, Docker); Collector version: [Deployment]
- Signals and sources: which apps send OTLP over gRPC or HTTP, which hosts need host metrics, which log files to tail and their format: [Signals]
- Backend exporters: vendor or self hosted endpoints per signal, auth header names (never values), TLS needs: [Backends]
- Sensitive attributes to remove or hash, such as user.email, http.request.header.authorization, client IPs: [PiiFields]
- Sampling goals: keep all errors, keep slow traces above a threshold, a baseline percentage for the rest: [SamplingPolicy]
- Container or host memory limit for each Collector: [MemoryBudget]
- Output format: [Format]

Generate:
1. A topology note: what runs on the agent and what runs on the gateway. Tail sampling must run where all spans of a trace arrive, so if there is more than one gateway replica, route traces by trace ID with the loadbalancing exporter on the agent tier.
2. Receivers: otlp with grpc and http endpoints set explicitly (bind to 0.0.0.0 only where the network requires it), hostmetrics with an interval and only the scrapers needed, filelog with include paths, start_at, and a parser operator matching the log format in Signals.
3. Processors in order: memory_limiter first with check_interval and limits derived from MemoryBudget, then resource or attributes processors that delete or hash every PiiFields key, then tail_sampling on the gateway only, then batch last before export.
4. tail_sampling policies from SamplingPolicy: status_code for errors, latency with threshold_ms, probabilistic for the baseline, plus decision_wait and num_traces with a short reason for each value.
5. Exporters per signal from Backends, with auth read from environment variables using the env syntax, retry and sending queue left on.
6. Extensions: health_check and zpages, listed under service.extensions, with ports noted for probes.
7. service.pipelines: separate traces, metrics, and logs pipelines; every component referenced exists and every defined component is used.
8. Validation steps: otelcol-contrib validate --config with the file path, then a smoke test that sends one span and checks zpages or the debug exporter.
9. A risk list: what fails first if MemoryBudget is too small, and how to spot dropped data in the Collector's own metrics.

Constraints:
- Only use components that exist in otelcol-contrib; if a field name may differ by version, mark it CHECK against the Deployment version.
- Never put secrets in YAML. No em dashes. Keep comments short and inside the YAML.