feat: complete foundation telemetry and identity safety

[BeforeLights]

Summary

• Reconciles the single CodeRabbit promotion review for PR chore: promote development history slice 3 #33 through focused fixes and a disposition record.
• Completes content-safe telemetry boundaries across TypeScript, Python, Android, API correlation, hostile provider inputs, exporter/clock failures, and traceparent propagation.
• Hardens IAM MFA persistence/proof/clock behavior and BUA usage identity and tenant-scope invariants.

Verification

• corepack pnpm repo:check (21 tasks green; API 294/294)
• corepack pnpm repo:build (12 tasks green)
• Android TelemetryContract unit tests with Android SDK
• Engine telemetry pytest/ruff

Review policy

This is a feature PR to dev. CodeRabbit is intentionally not invoked here; promotion to main will receive exactly one full CodeRabbit review per repository policy.

Commit budget

31 substantive commits; within the requested 30-50 target and below the hard 79-commit ceiling.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: ec4a66a0-4023-4d2b-8164-e2683e637a32

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}