feat(telemetry): add anonymous opt-out OpenShell usage telemetry

[kirit93]

Summary

Add lightweight, opt-out telemetry for anonymous OpenShell usage metrics. This gives the project aggregate visibility into sandbox lifecycle activity, policy updates, provider operations, sandbox creation shape, and policy-denial activity without collecting sandbox IDs, names, hosts, paths, model names, provider names, credentials, or user content.

Related Issue

Fixes #1054

Testing

• mise run pre-commit passes
• Unit tests added/updated

Checklist

• Follows Conventional Commits
• Commits are signed off (DCO)

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[github-actions]

🌿 Preview your docs: https://nvidia-preview-pr-1433.docs.buildwithfern.com/openshell

[zredlined]

Looks like the Rust telemetry helper shells out to python3 and defaults to running scripts/publish_telemetry.py from the source tree. I’m worried this will likely no-op in packaged/runtime environments: the gateway image is distroless, the supervisor image is scratch, and neither appears to include Python or the telemetry script. Since failures are intentionally silent, we may not notice that telemetry never publishes outside local/dev setups.

Suggestion: we might want to implement the telemetry publisher fully in Rust for better portability. That would keep the runtime behavior inside the shipped binaries, avoid depending on Python/script packaging, and make the opt-out/publish path easier to test across gateway, supervisor, and package installs.

[zredlined]

@kirit93 Can you add a short telemetry section to the primary README as part of this PR?