feat(telemetry): opt-in scaffold, default OFF (spec 20)

[gustavobertoi]

What

Implements the opt-in, privacy-first usage-telemetry scaffold from spec 20. It is default OFF and, critically, ship-empty: no real network endpoint is wired. The only sink actually used is the no-op sink, so even when a user opts in, nothing leaves the machine.

Changes

• internal/telemetry (new):
  • Event — the exhaustive allowlist of coarse, non-identifying fields (command path, flag names, ok/error outcome, error-category enum, bucketed duration, os/arch, is_wsl2, tool version, random install id). No map[string]string escape hatch, so PII is structurally impossible to attach (asserted by a reflection test).
  • Sink interface + NoopSink (the only wired sink; DefaultSink() returns it, DefaultEndpoint is empty).
  • HTTPSink — a pluggable transport that is unused and disabled by default (empty endpoint = no-op), with a clearly documented TODO to wire a pure-Go OTLP/HTTP exporter once a project-operated collector + privacy policy exist.
  • Recorder — the consent gate; when disabled it short-circuits before ever touching the sink (different branch from "sampled out"), and swallows sink errors (best-effort).
  • CategorizeError — maps wrapped-error signatures to a closed enum; the raw err.Error() (which can embed paths/IPs/usernames) is never returned or transmitted.
• internal/store: telemetry consent persisted in the global $DEVSTACK_HOME/config.yaml (never committed, never in the ledger). Default false; enable mints a UUIDv4 install id + consentAt; disable clears them.
• internal/cli: real telemetry status | enable | disable | show group, each with a --json non-TTY equivalent. show prints, byte-for-byte, the exact allowlisted event that would be sent and performs zero network I/O. Removed only the telemetry line from stubs.go.

Why

Lets a small OSS team eventually learn coarse usage/failure patterns without ever betraying trust — but ships the trust primitives (consent, allowlist, redaction, radical-transparency show) first and defers any real endpoint.

Ship-empty — no endpoint wired

There is no real network endpoint in this change. DefaultEndpoint is empty and DefaultSink() is the no-op sink; the HTTPSink exists only as a disabled, documented placeholder. Enabling telemetry currently sends nothing.

How tested

CGO_ENABLED=0 go build ./..., CGO_ENABLED=1 go test ./internal/..., gofmt -l (clean), go vet ./... — all green. New tests cover: disabled Recorder never calls a mock sink; enable→disable round-trips in the global config (and doesn't clobber shared services); Event is allowlist-only and redacts a raw error string (no path/IP/secret leak in the marshaled payload); duration bucketing; error categorization; --json status; and telemetry show emits only allowlisted keys.

🤖 Generated with Claude Code