feat(analytics): add privacy-safe product usage event spine

[JSONbored]

Background

We cannot improve adoption or justify Gittensory’s ecosystem value without measuring usage. Product telemetry must be privacy-safe and separate from security audit logs.

Goal

Add product usage events for MCP, API, GitHub App, branch analysis, decision packs, PR packets, comments, labels, quiet skips, and package versions.

Current Behavior

Gittensory records operational/audit context, but does not have a clear product analytics event spine.

Desired Behavior

Every major user-facing action emits a redacted product usage event suitable for rollups and value reporting.

Implementation Requirements

• Design product usage event schema separate from audit events.
• Classify surface, route/tool/command, actor/session hash, repo, outcome, latency, and client version where safe.
• Do not store source contents, tokens, private local paths, wallets, hotkeys, or raw trust data.
• Add rate-limit/error outcome classification.
• Keep events Worker-safe and batchable.

Public/Private Output Boundaries

Public GitHub output must never include wallets, hotkeys, payout/reward estimates, raw trust scores, public score estimates, private reviewability, private scoreability context, or farming language. Private API/MCP/control-panel surfaces may show authenticated scoreability, blockers, projections, and evidence, but must not claim guaranteed payout outcomes.

Acceptance Criteria

• No source contents, tokens, private local paths, wallets, hotkeys, or raw trust data.
• Event schema supports rollups.
• User/session/repo IDs are privacy-safe.
• Tests cover redaction and event classification.

Testing Requirements

• npm run test:ci must pass.
• Global coverage must remain at or above 97% for lines, statements, functions, and branches.
• Aim for 98%+ branch coverage locally.
• Add tests for every new branch, fallback path, sanitizer rule, and regression.
• Add invariant/property-style tests when behavior depends on sorting, gating, scoring, source-upload safety, public/private boundaries, or telemetry privacy.
• MCP/local tooling must prove source contents are not uploaded when local metadata is involved.
• Public GitHub output must be tested against forbidden language: wallet, hotkey, raw trust score, payout, reward estimate, farming, private reviewability, and public score estimate.