feat(miner-discovery-plane): add anonymized telemetry event schema for the optional hosted plane

[JSONbored]

Worth disambiguating from a similarly-worded sibling item up front: the tracker (#2353, Phase 4) separately lists feat(miner-manage): optional anonymized Orb telemetry export for miner outcomes — that item extends the EXISTING Orb collector (src/selfhost/orb-collector.ts, live since #1255) to also ingest miner-outcome events, for the review stack's own fleet calibration. This issue is a different plane: telemetry for the Phase 6 hosted discovery-index service (#4250) — e.g., which candidates a miner fetched/ranked, whether a soft-claim succeeded or collided — so the shared discovery service can be operated and debugged without holding source, diffs, or credentials. Same anonymization posture, different destination and different event content; this should not be read as duplicate scope with the Phase 4 item.

src/selfhost/orb-collector.ts is nonetheless the right concrete pattern to copy the posture from, since it is the one real, shipped precedent in this repo for "anonymized telemetry leaving an instance": HMAC-hashed repo/PR identifiers keyed by a per-instance dedicated secret that the collector itself never holds (getOrCreateAnonSecret, hmacField — explicitly never the GitHub App private key or the webhook secret, "key separation"), a fixed low-cardinality bucketReasonCode mapping instead of raw free-text reasons, and an explicit inventory of what never leaves the instance: "No diffs, no code, no comments, no logins, no commit SHAs" (orb-collector.ts:1-18, header comment). The discovery-plane telemetry schema should state the equivalent inventory for its own domain (no source contents, no GitHub tokens, no full issue bodies) and reuse the same HMAC-with-local-secret shape for repo/issue identifiers rather than inventing a new anonymization primitive.

Deliverables

• A typed MinerTelemetryEvent-style schema (in @jsonbored/gittensory-engine, consistent with where the discovery-index contract, sibling issue, lives) covering the discovery-plane's own event types (e.g. query issued, candidates returned, soft-claim attempted/succeeded/collided) — not review-outcome events, which stay Orb's domain.
• Reuse an HMAC-with-per-instance-secret shape for any repo/issue identifiers in the payload, following getOrCreateAnonSecret/hmacField's pattern (src/selfhost/orb-collector.ts:63-93) rather than a new scheme.
• A bucketed/low-cardinality categorization for any free-text-adjacent fields, following bucketReasonCode's approach (src/selfhost/orb-collector.ts:97-107).
• An explicit "never included" list in the schema's doc comment, matching the concrete inventory style of orb-collector.ts's own header comment (:1-18).
• Schema/types only — no exporter, no wire-up to an actual endpoint (the endpoint itself is feat(discovery-plane): stand up the hosted discovery-index server #4250's scope).

References

• Tracker 🧩 Wave 2 — Analyze, Plan, Create & Deploy (HELD tracker) #2353, Phase 4 — feat(miner-manage): optional anonymized Orb telemetry export for miner outcomes (the differently-scoped sibling item this issue is NOT duplicating).
• src/selfhost/orb-collector.ts:1-18 (header comment), :63-93 (getOrCreateAnonSecret, hmacField), :97-107 (bucketReasonCode) — the anonymization posture/pattern to reuse.
• feat(discovery-plane): stand up the hosted discovery-index server #4250 (feat(discovery-plane): stand up the hosted discovery-index server) — the eventual consumer of this schema.
• Sibling Phase 6 issue: feat(miner-discovery-plane): define the public-data-only discovery-index API contract — related contract this schema should stay consistent with stylistically.

[linear-code]

JSO-3288