docs(rtk): record RTK_TELEMETRY_DISABLED as the supported opt-out (#117)

[gatezh]

Closes #117.

Why now

The trigger recorded in #117 — "stable v0.44.0 or later in /releases/latest" — is met: rtk /releases/latest returns v0.48.0 (2026-09-04), and #121 has pinned both images to RTK_VERSION=0.48.0.

Upstream rtk-ai/rtk#1307 is closed, fixed by rtk-ai/rtk#2477 (merged 2026-07-20, released in v0.44.0). Verified the fix commit 66e09cbe is an ancestor of both v0.44.0 and v0.48.0 (behind_by=0), rather than trusting the milestone.

What changed

Across the three rtk init sites:

• .devcontainer/init-plugins.sh
• claude-code/.devcontainer/init-plugins.sh
• ralphex-fe/init-docker.sh

Against the #117 checklist:

• Confirm /releases/latest >= v0.44.0 — v0.48.0, and images now pinned to it
• Keep RTK_TELEMETRY_DISABLED=1 — it is now the canonical suppression mechanism
• Update the # Remove when upstream fixes it comments
• Drop the timeout 10 guard — deliberately kept, see below

Two judgement calls

The env var must not be dropped later. Upstream fixed this by making RTK_TELEMETRY_DISABLED=1 short-circuit the consent prompt before the TTY heuristic — it did not add non-TTY auto-detection. The original TTY check is precisely what failed, because a devcontainer postCreateCommand is handed a pseudo-TTY and the prompt believes it is interactive. The new comments say this explicitly so nobody removes the env var assuming rtk detects CI on its own.

timeout stays, though #117 listed it as droppable:

• rtk-ai/rtk#3693 is open (priority:high, area:security) against this same rtk init -g invocation — it deletes ~/.claude/hooks/rtk-rewrite.sh and can silently leave rtk fully unregistered, exiting 0 with a success banner.
• The root .devcontainer/Dockerfile resolves rtk from releases/latest at build time, so a future regression lands there unpinned.
• In ralphex-fe/init-docker.sh the var is passed through gosu; it does propagate, but with timeout gone that propagation becomes the only thing preventing an indefinite hang.

Cost is one word; the failure it prevents is a container that never finishes creating.

On the 10 specifically — reviewed and kept as-is. timeout N is a ceiling, not a sleep: it returns the instant the command does, so the value costs nothing on the happy path. Measured rtk init -g --hook-only --auto-patch (rtk 0.48.0) at 18 ms against a warm $HOME and 8 ms against a fresh one, with no network call. Lowering it to 1–3 s would save zero time and would only risk false-killing a working init under QEMU emulation or a loaded runner — silently, since all three call sites end in || true.

Review follow-ups (second commit)

Two things the first commit got wrong:

Exec bits. It flipped .devcontainer/init-plugins.sh and ralphex-fe/init-docker.sh from 100755 to 100644. Nothing broke — the two init-plugins.sh are templates invoked as bash <path>, and init-docker.sh is chmod +x'd at ralphex-fe/Dockerfile:154 — but the change was undeclared, and the verification below could not have caught it. Restored.

A stale claim left standing. ralphex-fe/init-docker.sh said the rtk init covers "standalone usage (no host mount)", but the block sits inside if [ -d /mnt/claude ] — exactly the condition that is false without the mount, so rtk is silently inert there. The comment now describes what the code does. The behavioural gap is deliberately not fixed here: moving the init outside the guard also needs the mkdir -p/chown above it moved, which is more than a docs branch should carry.

Verification

• bash -n and shellcheck clean on all three scripts
• git diff --summary used to confirm the tree has no remaining mode changes (the first commit's "every changed line begins with #" check was blind to mode bits — that is how the exec-bit flip got through)

Not in scope — filed separately

• Normalize .sh file modes across the repo #127 — normalize .sh file modes repo-wide (this PR restores rather than normalizes).
• ralphex-fe: rtk is never initialized when the container runs without /mnt/claude #128 — ralphex-fe standalone (no /mnt/claude) never initialises rtk. Pre-existing; the fix has to hoist the mkdir -p/chown out of the guard too.
• Track rtk-ai/rtk#3693: 'rtk init -g' can silently unregister rtk #129 — tracking rtk init -g deletes the legacy hook script and either unregisters rtk entirely or leaves a dangling reference — both reported as "RTK hook registered (global)" rtk-ai/rtk#3693, the live upstream bug that is part of why timeout stays.
• Harden the three rtk init call sites with < /dev/null #130 — add < /dev/null to the three invocations, which prevents the consent-prompt hang outright rather than killing it after 10 s.