Implement signed, anonymized signature-bundle export for federated fleet intelligence

[JSONbored]

Context

src/selfhost/orb-collector.ts already computes local calibration signals for a self-hosted instance, and already respects the ORB_AIR_GAP posture (src/selfhost/orb-collector.ts:157 — when set, nothing leaves the instance). src/orb/analytics.ts holds related local analytics. #1970 (opt-in federated fleet intelligence) needs a way to package a subset of that local calibration data into a signed, anonymized bundle an operator can choose to export — this issue is that export path only, not the import/consume side (sibling issue) and not the trust-gating rule itself (#6477, a separate maintainer-only design issue this one is NOT blocked by — the bundle format doesn't need the poisoning-resistance rule decided first, only the import side does).

Requirements

• Opt-in only, mirroring ORB_AIR_GAP's existing default-private posture: exporting is disabled unless an operator explicitly enables it via .loopover.yml config-as-code (a new features.federatedIntelligence or equivalent toggle — follow the existing FocusManifestReviewConfig wiring pattern used by every other opt-in feature in this codebase, do not hardcode).
• The exported bundle contains only anonymized calibration/slop/copycat signatures — never source code, diffs, GitHub logins, repo names, or any other directly-identifying data. Enumerate exactly which fields are included in the issue's own PR description before merging, so this is auditable.
• HMAC-sign the bundle so a receiving instance can verify it wasn't tampered with in transit. The signing-key scheme itself (how a key is established/rotated) is scoped by Design: trust-gating/anti-poisoning scoring rules for federated signal-bundle import #6477 — if that design isn't done yet when this is picked up, use a placeholder key-derivation function behind a clearly marked TODO(#6477) and file the actual key-management as a small blocked follow-up rather than inventing the trust scheme here.
• Fail-safe: if the export path errors for any reason, it must never affect the gate's own review/merge behavior — matches every other feature's existing fail-safe convention in this codebase.
• Byte-identical when off: an instance that hasn't opted in produces zero behavior change and zero new network calls.

Deliverables

• A .loopover.yml-gated export function producing a signed, anonymized bundle from local calibration data.
• Unit tests covering: opted-out instance produces no bundle/no network call, opted-in instance produces a correctly-signed bundle, the bundle contains only the enumerated anonymized fields (a snapshot/schema test that fails if a new field is added without deliberate review is strongly preferred here).
• .loopover.yml.example / config/examples/loopover.full.yml updated with the new toggle and a comment explaining what it does.

Test Coverage Requirements

99%+ Codecov patch coverage on the diff (this touches src/**, which is in coverage.include) — including both branches of the opt-in check (on and off) and the fail-safe error path.

Expected Outcome

An operator can opt into exporting a signed, anonymized calibration bundle from their self-hosted instance; an operator who hasn't opted in sees zero behavior change.

Links & Resources

• Opt-in federated fleet intelligence across self-hosted instances #1970 (parent — federated fleet intelligence)
• Design: trust-gating/anti-poisoning scoring rules for federated signal-bundle import #6477 (sibling — trust-gating/anti-poisoning design; not a blocker for this issue, only for the import side)
• src/selfhost/orb-collector.ts, src/orb/analytics.ts

[linear-code]

JSO-4444