fix(#50): enforce telemetry retention automatically, report footprint, drop fixed /tmp backup path

[bigknoxy]

Closes #50.

1. Retention was never enforced

pruneEvents existed but was reachable only through the manual telemetry prune command, so retentionDays was configuration nobody's store obeyed. Steady-state growth for an active user is unbounded, in $HOME, forever — and nobody runs the command because nobody knows the file is growing.

recordEvent now sweeps rotated logs past retentionDays and collects orphaned diff payloads in the same pass. The prune reads every event (payload GC needs the full reference set), so it cannot run per write: a .last-prune marker gates it to once a day, and the cost on every other invocation is a single statSync. The marker is touched before the prune runs, so a prune that throws does not become a hot loop over the log — losing a day of retention beats that.

(maxFileSize was already enforced automatically via maybeRotate(); retention was the gap.)

2. Footprint was invisible

diskUsage() totals the active log, every rotated log, and the payload store. telemetry health reports it as diskBytes and warns past 100 MB; doctor gains a telemetry-size check — a warn, never a fail, because a large log is not a broken install. diskBytes is a point-in-time property, so on --trend output it is populated on current and always 0 on previous.

3. Backup written to a fixed world-writable path

install.sh copied the log — which can contain source diffs — to /tmp/hashpilot-telemetry-backup. A fixed path in a world-writable directory is readable by any local user and a symlink-attack target. It now uses mktemp -d "$TARGET_DIR/.telemetry-backup.XXXXXX", chmod 700 on the directory and 600 on the copy, with the restore leg reading the same variable. rg '/tmp/' scripts/ is now empty and a test asserts it stays that way.

Verification

• tests/telemetry-retention-50.test.ts — 9 tests: default-retention prune, configured retentionDays: 5, marker gating (no re-prune inside the interval, re-prunes once aged), a latency assertion on the already-pruned path against a 20,000-line log, diskBytes covering payloads, the doctor check, and static assertions on install.sh.
• Falsification: removing the maybeAutoPrune() call fails 3 tests.
• Full suite 875 pass / 0 fail; bun run lint:docs clean; bash -n and shellcheck clean on install.sh.
• No bench case: retention and install-script defects are outside the bench harness's edit-correctness model.

Contract: docs/ADAPTER-CONTRACT.md documents the new diskBytes field and threshold. README and ARCHITECTURE updated.

🤖 Generated with Claude Code

[bigknoxy]

🎉 This PR is included in version 4.4.16 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀