feat(desktop): add privacy-safe incident diagnostics

[Git-on-my-level]

Summary

• Add typed, rate-limited user-visible PTT and chat reliability metrics.
• Attach bounded, cloud-safe incident context to Sentry crashes, actionable errors, and feedback diagnostics.
• Remove default Sentry email/display-name identity and generic free-form log breadcrumbs.
• Replace raw feedback-log attachments with redacted diagnostics only.

Privacy impact

• Cloud incident bundles retain only allowlisted incident snapshot fields and bounded operational log lines.
• Raw feedback text, name, email, local paths, tokens, device names, generic log text, and backend detail strings are excluded.
• Temporary Sentry attachment files are deleted after capture.

Product invariants affected

• INV-AUTH-1

Failure class

• observability_privacy_regression

Validation

• xcrun swift test --package-path Desktop — 2,856 tests passed.
• Focused diagnostics, feedback, and export suites passed.
• xcrun swift build -c debug --package-path Desktop passed.
• SwiftLint, test-quality, and diff hygiene passed.

Follow-up

• This is the first privacy-safe incident slice; universal lifecycle correlation and a full PostHog schema firewall remain separate work.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1891aa9d18

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Keep user reports in the Sentry feedback lane

When users click Send Report, this path now only calls capture(message:); the previous SentryFeedback submission was removed. The desktop backend only creates support action items for Sentry issues whose issueCategory is feedback, and its poller also queries issue.category:feedback (desktop/macos/Backend-Rust/src/routes/webhooks.rs:160 and :558), so these report events will be ignored by the existing feedback ingestion while the UI shows success. Keep a privacy-safe feedback-category submission, even with a generic message, or update the ingestion path at the same time.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Give redacted errors a stable Sentry fingerprint

For production calls to logError(..., error:), every distinct actionable failure now reaches Sentry with the identical message Desktop error, and the differentiators are only stored as context; there is no fingerprint set anywhere under Desktop/Sources. That means unrelated failures reported through this common helper can collapse into the same Sentry issue, hiding new regressions and making the new diagnostics much harder to triage. Use a privacy-safe fingerprint/title derived from fields like error_type, domain, and code.

Useful? React with 👍 / 👎.