Add desktop telemetry with opt-out (S6)

[davidmckayv]

Desktop setup currently has no telemetry before credentials are available, so failures and abandoned installs are missing from the setup funnel. This adds the S6 native emitter, setup events, and runtime identity handoff.

Telemetry is enabled by default, disclosed on Welcome, and disabled by either COPILOTKIT_TELEMETRY_DISABLED=true|1 or DO_NOT_TRACK=true|1. Opt-out prevents recording and delivery and removes queued events. The event schema permits closed enums, booleans, numeric counters and numeric versions; prompts, answers, credentials, paths and custom URLs are excluded.

The native emitter persists a random install UUID and queued events before sending, replays after relaunch, and flushes on quit. Setup tracks steps, engine/Windows outcomes, image pulls, harness/credential categories, first successful Bot answer and abandonment. The runtime receives the same UUID, desktop metadata and sampling rate 1. Image-byte counts remain unknown when Compose supplies no counters; older providers keep their existing pull behavior.

Validation:

• GitHub CI passes for the main repository workflow, native formatting/lint, and macOS/Windows/Linux packaging and Rust regressions.

• 24 native regressions pass, including the actual registered Tauri IPC privacy boundary, concurrent delivery/quit, replay and pull metrics.

• 66 focused frontend tests and 9 server metadata tests pass; desktop/server type checks, Biome, Rust formatting and Clippy pass.

• Built the macOS .app bundle. Headed Chrome exercised Welcome → harness → model and confirmed the disclosure and emitted events, using synthetic Tauri IPC.

• Separate-process local HTTP validation exercised offline recovery, quit, activation deduplication, and the installed runtime 1.70.1. Native/runtime UUIDs matched; both opt-out variables with true and 1 produced zero sends. The existing local Bun cache needed an explicit NODE_PATH to its existing hoisted dependencies; no dependencies were installed or changed.

• A real Compose pull validated duration capture and unknown-byte handling. No AI credentials, AWS machine, or production telemetry destination was used for S6 validation.

Production desktop ingestion depends on oss-path-to-production #290 being merged and deployed; its CI passes. The runtime metadata helper must ship in the next OpenBot deployment release too. Local HTTP success does not establish production/PostHog acceptance. Windows/Linux builds and regressions run in the existing platform CI; native UI validation on those systems is not claimed here.

See desktop/TELEMETRY.md for the allowlist, delivery behavior and repeatable validation command.

Closes FOR-299.

[linear-code]

FOR-299

OSS-1186