PostHog error tracking for the miner CLI (opt-in seam swap; egress-allowlist + env-reference coupling)

[JSONbored]

Part of epic #8286 (Phase 1 — Errors).

Strategy correction (2026-07-25): this is a full replacement, not a parallel-run. Every completed
sibling (self-host #8287, hosted Worker #8288, discovery-index #8289, review-enrichment #8290) deleted its
Sentry module outright in the same PR — no bake period, no side-by-side capture window. Treat any earlier
"keep Sentry working in parallel" language in this repo as stale; it predates that correction.

Not blocked by #7875 (the loopover-owned hosted-fleet PostHog project) — that issue is scoped to the hosted
fleet's own centrally-owned key; this issue is the operator-facing opt-in seam only (an operator points at
their own PostHog project, exactly like the Sentry module it replaces), same boundary as before.

Current state

packages/loopover-miner/lib/sentry.ts (#6011): opt-in error tracking for the published miner CLI — complete
no-op unless LOOPOVER_MINER_SENTRY_DSN is set, operator points at their own project, lazy @sentry/node
import (the CLI runs frequently under the unattended loop; unconfigured runs pay zero module-load cost),
explicit captureMinerError call sites (in process-lifecycle.ts, attempt-runner.ts, attempt-cli.ts,
chat-action-dispatch.ts, discovery-index-client.ts, bin entry points).

Three coupling points make this more than a module swap:

1. Egress firewall (Enforce AMS sandbox network-egress deny-by-default + allowlist (implements #7648) #7857): packages/loopover-miner/lib/egress-allowlist.ts allowlists the host parsed
   from LOOPOVER_MINER_SENTRY_DSN under the loopover-platform reason — the replacement env var must be
   allowlisted the same way or opted-in error reporting is silently firewalled.
2. Env reference generators: LOOPOVER_MINER_SENTRY_* appear in packages/loopover-miner/docs/env-reference.md
   • apps/loopover-ui/src/lib/ams-env-reference.ts — npm run miner:env-reference must be regenerated (stale
     output fails CI).
3. _FILE secret support: the DSN participates in loadMinerFileSecrets() mounted-secret resolution — the
   PostHog key must too.

Deliverables

• LOOPOVER_MINER_POSTHOG_API_KEY / LOOPOVER_MINER_POSTHOG_HOST opt-in seam replacing the Sentry
  module's role: lazy posthog-node import, captureMinerError's signature and never-throws contract
  preserved so call sites don't churn, $exception capture with the context object as scrubbed properties.
• Delete packages/loopover-miner/lib/sentry.ts, @sentry/node, and every LOOPOVER_MINER_SENTRY_*
  reference outright in this PR (with a deprecation note in the miner changelog — published CLI, operators
  have configs referencing the old vars).
• If a release/version tag is attached to captured events (recommended — mirror
  src/selfhost/posthog.ts's resolvePostHogRelease/activeRelease pattern, e.g. the CLI's own
  package.json version), make sure it is actually wired into every capturePostHogError-equivalent call
  site. Self-host shipped a resolver function that computed a release id but never attached it to any capture
  call for weeks before that gap was caught and fixed tonight (fix(posthog): compare symbol-set release as a nested object, not a string #8629's sibling fix) — don't repeat that:
  if you add a resolver, add the property assignment at every capture call site in the same commit, and add a
  test asserting release is actually present on a captured event's properties (not just that the resolver
  function returns the right string in isolation).
• Short-lived-process flush semantics: flushAt: 1, flushInterval: 0 + explicit shutdown, the exact
  pattern packages/loopover-mcp/lib/telemetry.ts (feat(mcp): instrument the local MCP tool-dispatch chokepoint with PostHog events (opt-in) #6238) already proves for opt-in CLI telemetry.
• egress-allowlist.ts: allowlist the PostHog host env alongside the (now-deleted) Sentry DSN host.
• _FILE mounted-secret support; npm run miner:env-reference regenerated; DEPLOYMENT.md updated.
• Tests: seam no-op/enabled paths, flush-on-exit, egress-allowlist entries for the new vars, redaction of
  context, and (per the bullet above) an explicit assertion that release/version actually lands in a captured
  event's properties.

Boundaries

• Hosted tenant containers consuming the loopover-owned key is Wire hosted control-plane + tenant containers to report to the central PostHog project (implements #4934) #7876's scope — this issue is the
  operator-facing opt-in seam only.

Resources

• packages/loopover-mcp/lib/telemetry.ts — the in-repo short-lived-CLI PostHog precedent
• src/selfhost/posthog.ts — the corrected release-wiring pattern (activeRelease, set in initPostHog,
  attached in every capture call)
• https://posthog.com/docs/error-tracking/capture

[linear-code]

JSO-5735