Add minimal, anonymous usage telemetry

[sdairs]

Closes #283

Default-on anonymous usage telemetry with a Homebrew-style consent model: nothing is ever sent before the first-run notice has been shown.

Consent & state

• ~/.clickhouse/telemetry.json ({"disabled": false}) doubles as the first-run marker. First run: write file → print notice to stderr (regardless of TTY) → send nothing. The notice is gated on the write succeeding, so an unwritable config dir fails open to disabled — no send, no error, no repeated notice.
• DO_NOT_TRACK (donottrack.sh spec: set and not ""/"0"/"false") is checked first and overrides everything.
• clickhousectl telemetry enable|disable|status manages the file. Consent is evaluated after the command runs, so telemetry disable silences its own event and telemetry enable sends one.

Payload

{"command":"local list","flags":["json"],"exit_code":0,"is_agent":true,"agent":"claude-code","ci":false,"version":"0.3.1","os":"macos","arch":"aarch64"}

command (path), flags (long names only), exit_code (gh-style: 0 success, 1 error, 2 cancelled, 4 auth required), is_agent + agent (canonical id from is-ai-agent, null for humans), ci (CI env), version, os, arch. No install ID, no fingerprinting. Agent, version, and exit code are set client-side from structured values rather than extracted worker-side from headers.

Values are structurally unreachable: main now parses via ArgMatches, and telemetry::capture walks only arg ids and Arg metadata (never get_one/get_raw), skipping positionals and non-command-line sources. A unit fixture asserts a payload built from cloud service get SECRET-ID --org-id SECRET-ORG contains no SECRET, and an integration test asserts the same over the wire.

Transport

Detached child process (telemetry send, hidden subcommand): payload via child env var, all stdio nulled, parent never waits; child fires one POST with a 2s timeout and dies silently on any failure. Measured ~0.3s command wall-clock with the endpoint blackholed. The child is short-circuited in main before dispatch, so a send can never trigger another send.

Every POST carries the canonical User-Agent (clickhousectl/<version>, optionally (agent=<id>)) via the shared http::client_builder(), pinned by a wire-level test — the ingest worker can reject anything without the clickhousectl/ prefix.

Transparency & opt-outs

• CHCTL_TELEMETRY_DEBUG=1 prints the exact payload to stderr and sends nothing.
• CHCTL_TELEMETRY_URL overrides the endpoint (tests / local worker dev).
• Cargo feature telemetry (default-on): --no-default-features compiles the whole thing out including the subcommand — enforced by new CI steps.
• README section documenting all of the above.

Tests

• Unit: consent state machine (DNT precedence, first-run, unwritable dir, corrupt file), donottrack truthiness, payload key set + agent-field consistency, capture fixtures (no-leak, global-flag dedupe, default-value exclusion).
• Integration (tests/telemetry_test.rs, subprocess + wiremock + sandboxed HOME): first-run notice/marker/no-send, payload shape + User-Agent prefix, failure exit code + positional non-leak, DNT silence, disable/enable persistence, debug mode, unwritable-HOME fail-open, parent-never-waits latency.
• Existing subprocess tests now set DO_NOT_TRACK=1 so test runs never write real state or POST to production.

Verified end-to-end against the telemetry worker running locally (wrangler dev): first run silent, subsequent runs delivered events the worker accepted and inserted (200 OK).

Worker-side follow-ups (separate repo, in dev)

• exit_code (number) replaces success (bool) — needs a numeric coercer + column (success is derivable as exit_code = 0).
• is_agent is now a payload bool (was agent), and agent is the agent id string (null for humans) — needs a column + coercion update in toRow.
• Optionally reject requests whose User-Agent doesn't start with clickhousectl/.

Pre-release TODO (not this PR)

• Publish the telemetry docs section at https://clickhouse.com/docs/interfaces/cli#telemetry (the URL baked into the notice/README) before tagging a release; announce in changelog.

🤖 Generated with Claude Code

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 3 potential issues.

There are 5 total unresolved issues (including 2 from previous reviews).

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 428bf07. Configure here.}