Calls from the PHONE Port are a two step process. The first step evaluates input from the PHONE Port though the PHONE Port DigitMap, possibly transforming the entered number (as in your case, where **2 is prepended to various patterns). The resulting number is then evaluated through the PHONE Port OutboundCallRoute, where transformation often occurs again (such as removing **2 before passing the number to SP2). This two-step process does not occur from InboundCallRoute's.
When you use Circle-of-Trust from the OBiTALK Web Portal, a very minimal OBiTALK Service InboundCallRoute configuration is generated that doesn't use the normal trunk DigitMaps and doesn't support any trunk other than the PrimaryLine.
Since the PHONE Port OutboundCallRoute doesn't come into play from an InboundCallRoute, when you added **2 to dialed numbers, it simply went out the trunk with the rest of the number.
The following OBiTALK Service InboundCallRoute should mimic your PHONE Port behavior from both your (290000001) and your friend's (290000002) softphones:
Voice Service -> OBiTALK Service -> InboundCallRoute:
{(290000001|290000002)>(<0:01186>1[02-9]xx.|<0:01186>[2-9]xx.|011xx.|<00:011>xx.):sp2},
{(290000001|290000002)>(1xxxxxxxxxx|<1>[2-9]xxxxxxxxx|<1615>[2-9]xxxxxx):sp1},
{(290000001|290000002):aa},{ph}
See this post for a general purpose single-stage dialing configuration:
Single-Stage Dialing Through Any OBi Trunk