Build the shared telemetry client for completed installs and updates

## Parent and accepted scope

- Parent: #9540
- Accepted decision: #10435
- Accountable maintainer: Will Curran

This issue owns the shared NemoClaw TypeScript telemetry client and its first event.

Data Platform provisioning does not block local implementation or tests. Production delivery remains disabled until the NemoClaw client ID, schemas, and endpoints are provisioned.

## Outcome

After the canonical installer completes successfully, invoke the telemetry entry point once.

When delivery is enabled and not suppressed, the client makes one attempt to send:

- Event: `nemoclaw_install_completed`
- `operation`: `install` or `update`

Use `update` when the current update action supplies the private marker or when the installer starts over a recognized existing canonical NemoClaw-managed installation. Otherwise, use `install`.

This compatibility rule intentionally classifies a manual installer rerun over a recognized managed installation as `update`. Do not inspect parent processes or infer from unrecognized filesystem state.

## Closed event contract

Define events as a closed TypeScript union with runtime validation.

For this issue, the only accepted logical event is:

```text
nemoclaw_install_completed
operation: install | update
```

The validator must reject unknown event names, fields, and values before transport starts.

Do not add a generic metadata object, arbitrary attributes, or free-form fallback values. The shell must not supply JSON, versions, schemas, client IDs, endpoints, or other event metadata.

When production fields are provisioned, TypeScript must derive or supply them under the accepted fixed schema.

## Suppression and opt-out

Use `NEMOCLAW_DISABLE_TELEMETRY=1` as the user opt-out. Document it with the installer environment controls.

The top-level TypeScript client must return before telemetry state reads, event construction, validation, or network access when any condition applies:

- `NEMOCLAW_DISABLE_TELEMETRY=1`
- `CI=true` or `CI=1`
- `GITHUB_ACTIONS=true`
- `VITEST=true`
- `NODE_ENV=test`
- Production delivery configuration is absent

No enable override may bypass CI, test, or user suppression.

## Shell-to-TypeScript boundary

Use one private, closed marker for current `nemoclaw update` runs. The update action must overwrite inherited marker state before starting the installer.

For clients that predate the marker, capture only whether a recognized canonical managed installation exists before the installer changes its managed source. Keep this classification in the shell, then pass TypeScript only the final `install` or `update` value.

At the end of `scripts/install.sh::main`:

1. Let `finalize_install()` return successfully.
2. Complete `clear_station_resume_after_completed_onboarding()`.
3. Invoke one hidden TypeScript telemetry command with only `install` or `update`.

Do not invoke telemetry from the root bootstrap, qualification-only installation phase, `runUpdateAction()`, or `finalize_install()` itself.

TypeScript owns suppression, event construction, validation, provisioning checks, and delivery.

The shell must ignore the telemetry command's result. A telemetry defect or delivery failure must not change the installer exit status.

## Delivery behavior

Each invocation handles one event and makes at most one network request.

The client must:

- Apply one overall five-second deadline to the complete attempt.
- Use no queue.
- Make no retry.
- Create no persistent outbox or delivery receipt.
- Preserve installation success after validation, connection, timeout, HTTP, or response failures.

If a request might have reached the receiver, stop without retrying it.

## Production delivery gate

Do not check in placeholder client IDs, schemas, or endpoints.

The default runtime client must have no production delivery configuration and must open no network connection.

Tests may inject a loopback receiver through test-owned construction. Do not add a runtime endpoint environment variable or CLI flag.

Production activation is outside this issue. It requires the provisioned client ID, accepted schemas, and confirmed endpoints.

## Acceptance criteria

- [ ] The shared TypeScript client accepts only `nemoclaw_install_completed` with `operation: install | update`; it rejects all other fields and values.
- [ ] Opt-out, CI, tests, and missing production configuration stop telemetry before event construction or network access.
- [ ] The installer classifies the current update marker or a recognized prior managed installation as `update`, classifies a clean or unrecognized installation as `install`, invokes TypeScript once after success, and never invokes it after failure.
- [ ] Delivery gets one five-second attempt with no queue, retry, or persistent state; failure cannot change installation success.
- [ ] Local receiver tests prove the contract, while production delivery remains disabled until the client ID, schemas, and endpoints are provisioned.

## Test plan

Add focused TypeScript tests that:

- Accept the two operations and reject every other event shape.
- Prove suppression occurs before construction, provisioning lookup, and transport.
- Send exactly one request to a receiver on `127.0.0.1` for each allowed operation.
- Prove refusal, HTTP failure, and timeout cause no retry.
- Prove the production deadline is five seconds.
- Prove the default unprovisioned client opens no connection.

Add installer integration tests that:

- Place the invocation after finalization and cleanup.
- Invoke once after success and never after failure.
- Preserve installer success when the telemetry command fails.
- Pass only the expected operation.
- Classify the current marker and a recognized older managed installation as `update`.
- Classify a clean or malformed prior installation as `install`.
- Classify a manual installer rerun over a recognized managed installation as `update`.

Extend the update-action tests to prove the private update marker is overwritten and propagated.

No live E2E test is required.

## Non-goals

- Other telemetry events from #9540
- Production activation or Data Platform provisioning
- Aggregate reporting
- Distinguishing a legacy update from a manual installer rerun over a recognized managed installation
- Classifying unrecognized or noncanonical prior installations
- Queues, batches, retries, receipts, or persistent delivery state
- A general-purpose telemetry SDK or plugin API
- Live NVIDIA telemetry calls from tests