feat(telemetry): track Argent Lens design-review funnel

[hubgan]

What

Adds three privacy-safe telemetry events for the Argent Lens design-review flow, capturing the human-decision funnel that the generic tool:* path can't see (submission is an HTTP POST, and the await_user_selection tool is hidden in argent lens CLI sessions):

• lens:preview_opened — a human loaded the preview UI (GET /preview/), deduped per round.
• lens:round_completed — the human submitted their picks (once per round, never on a resubmit).
• lens:round_abandoned — a staged round was discarded before submit (window closed, argent lens exited mid-review, or the round superseded).

Privacy

Payloads carry only aggregate counts, booleans, durations, and the device platform enum — never element names, comment text, variant code, file paths, or raw device ids. The store emits privacy-safe aggregate structs that are decoupled from the telemetry package; structural assignability to the event props is enforced at the track() call site (drift is a compile error).

Event fields

• preview_opened: round, element_count, variant_count, is_cli_session, platform
• round_completed: round, element_count, variant_count, annotation_count, element_comment_count, skipped_comment_count, has_global_comment, is_cli_session, had_parked_await, round_duration_ms, platform
• round_abandoned: round, element_count, variant_count, had_parked_await, is_cli_session, platform

Testing

• Unit tests for all three events: per-round dedup, exactly-once completion (no resubmit re-emit), abandoned vs happy-path roll, CLI up-front open, and content-agnostic privacy assertions.
• Verified end-to-end against a live tool-server: all three events fire with correct aggregate values and zero content leakage through the real sanitize pipeline.

[latekvo]

Reviewed end-to-end. Built the monorepo (tsc --build clean), ran the telemetry and tool-server suites plus both typecheck:tests gates (green - the one full-suite await-ui-element failure is a pre-existing timing flake that reproduces identically on unmodified main and is untouched here), and drove the real store -> real sanitize() pipeline with adversarial secret-laden inputs.

The privacy contract holds: every field is an aggregate count/boolean/duration or the coarse platform enum (classifyDevice never echoes a raw device id, even for a malformed one), with sanitize() as the enforced backstop. roundCompleted/roundAbandoned are exactly-once and mutually exclusive, the aggregate counts match their doc comments (including the asymmetric element_comment_count vs skipped_comment_count split), the compile-time drift guard between the store stats and the telemetry props genuinely fails on a mismatch, listener registration/removal is symmetric, and emission is throw-safe.

One item worth resolving is left inline: lens:preview_opened undercounts rounds in multi-round argent lens CLI sessions, which skews the open-to-complete funnel these events exist to measure. Approving, since the events are individually correct and privacy-safe and the rest of the change is thoroughly verified.

[latekvo]

Re-reviewed after the fixes in 379f92b (＋ a main merge to resolve a shutdown conflict). All fourteen inline findings are addressed and every one is verified — not just believed:

• preview_opened is now a single, visibility-gated client signal (POST /preview/opened): one open per round in a reused CLI window, no background-tab overcount, consistent count sampling across MCP/CLI, and platform omitted for a zero-proposal open so a surviving device can't attribute a CLI up-front open. GET / and the /variants poll no longer emit.
• TV attribution goes through a shared refineTvPlatform (factored out of http.ts), so a Lens session on a TV target reports tvos/android-tv like its tool:* events.
• Phantom completion is closed by a round token the store rejects when the round has rolled (route forwards it, UI sends it, usage flags reset on both paths).
• Dead CLI session: leftover round state is swept on every begin, so a killed predecessor's staged round is counted abandoned and can't bleed forward.
• Shutdown: relays stay attached until after server.close(), and a still-staged round is flushed as an abandonment before the drain.
• Drift guard is now bidirectional (compile-time key-set check); the docblocks (cliSessionStarted, drift, agent_choice_count 0/1) and the reset() abandonment comment are corrected; the privacy notice gains a design-review category.

Verification: tsc --build clean; telemetry (259) and full tool-server (2201) suites green; both typecheck:tests gates, ESLint, and Prettier pass; the drift guard proven to bite via a probe field; and a live end-to-end run against the real preview router + store + relay + sanitize() pipeline confirmed each event fires with correct aggregate values, the stale submit is rejected with no phantom completion, the CLI-exit abandonment is labeled is_cli_session:true, the up-front open omits the stale platform, and no element name / comment text leaks. CI is green on the head commit.

Approving.