feat(telemetry): add typed Sentry telemetry model and bootstrap

[cameroncooke]

Summary

Adds the data-minimization core: a closed typed telemetry model and the bootstrap that initializes Sentry and exposes the emit primitives. This is the privacy boundary expressed in code.

Stack: 2/10 · depends on PR 1 · Refs GH-183

What this changes

• SentryTelemetryModel.swift — closed enums (Category, Action, Transaction, Metric, SpanOperation, Attribute, plus ModelFamily/ProviderKind/ToolName/TokenBudgetBucket…). No Attribute case accepts an arbitrary String.
• SentryTelemetryBootstrap.swift — the only file that imports Sentry (gated). start() + addBreadcrumb/increment/gauge/distributionMilliseconds/trace/span primitives.

Business rules (the privacy boundary)

• No user content can be expressed. Attributes are closed enums, bools, counts, and buckets only.
• Counts are clamped: negative → dropped, capped at 999_999, so an internal count can't become a precise fingerprint.
• Unknown/custom tool names degrade to domain only (ToolName(rawValue:) returns nil).
• Raw model/provider names never escape — bucketed into ModelFamily/ProviderKind; token sizes bucketed into TokenBudgetBucket.
• start() config is conservative: sendDefaultPii = false; session replay, MetricKit, structured logs, auto network/file-IO/CoreData/auto-perf tracing all off; maxBreadcrumbs = 50, maxCacheItems = 30; only crashes, uncaught NSExceptions, and app-hangs auto-captured. tracesSampleRate 1 (debug) / 0.3 (prod).
• A literal Attribute.allowedKeys set + the single telemetryData(from:) funnel guarantee every emit path (breadcrumb/span/metric) is allow-listed identically.

Key decisions

• The model is an extension of the SentryTelemetryBootstrap enum, so the two files are one type and must ship together (this is why the PR is ~740 LOC and indivisible).
• Attributes are @autoclosure so a disabled build never even constructs the array (zero overhead).
• trace/span helpers tag is_error and finish spans; #else passthroughs make them transparent when telemetry is compiled out.

Note on size

~740 LOC, over the 500 target, but irreducible: splitting would either break the single-type relationship or change the final bytes.

Test plan

• Compiles in both modes (flag on/off). ✅ verified.
• (Contract unit tests were intentionally removed by the author and are not part of this stack.)

[cameroncooke]

• build(telemetry): generate and upload dSYMs in the release pipeline #332
• feat(telemetry): instrument Codex runtime events and session persistence #331
• feat(telemetry): instrument Agent Mode run lifecycle #330
• feat(telemetry): instrument workspace actions #329
• feat(telemetry): instrument file, prompt, selection and apply-edits tools #328
• feat(telemetry): instrument context builder tool runs #327
• feat(telemetry): instrument MCP tool dispatch and bootstrap admission #326
• feat(telemetry): start telemetry and trace app launch #325
• feat(telemetry): add typed Sentry telemetry model and bootstrap #324 👈 (View in Graphite)
• build(telemetry): link Sentry conditionally and document privacy model #323
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.