Send one cli.command telemetry event per run

[zmofei]

Stacked on #91.

Each run sends one cli.command event to Mapbox Events from a detached child, so the command never waits. The schema and Legal's review are in mapbox/event-schema#300.

• What's sent: the command, its options and outcome. Parameter values only for flags, enums, numbers and code-shaped language/country/types; coordinates send their name, other strings their length. README's Privacy section lists every field.
• Token: the user's token, then their login, then the CLI's own pk. token as a last fallback (cli_token.rs). A 401 tries the next one.
• Endpoint: production Events in every build. MAPBOX_INTERNAL_TELEMETRY_URL overrides it only in non-release builds.
• Skipped: MAPBOX_CLI_NO_TELEMETRY=1, completion, sudo, and uninstall on Windows.

Verified: tests against a loopback server; staging events reached the warehouse. Not verified: Windows locally, and the release pipeline's bundled token (mapbox-cli-private).

Before release: mapbox/event-schema#300 merges and MAPBOX_CLI_BUNDLED_TOKEN is set in mapbox-cli-private.

[mattpodwysocki]

Went deep on this one given what it's doing, first time this CLI sends anything recurring rather than a one-time install ping. Read telemetry_event.rs directly rather than trusting the description: coordinates really do send name only (classify() returns early for anything in COORDINATES, backed by every_numeric_location_parameter_is_a_coordinate which walks every bundled spec and fails the build if a future lon/lat-shaped parameter isn't added to that list), free strings really do reduce to length only, and language/country/types only send the actual value when it's strictly code-shaped. the_event_sends_only_fields_the_schema_declares diffing against a hand-maintained field list is exactly the kind of test that catches a field silently added later without a schema/legal update, and no_request_id_is_sent closes the one leak I'd have worried about most.

Confirmed it's genuinely fire-and-forget: the exit code is computed before run_record::finish() runs, and the actual POST happens in a detached child (reusing update_check's own detach() primitive), with a direct test that sends against a loopback server that never responds and confirms the command doesn't wait. Liked that MAPBOX_INTERNAL_TELEMETRY_URL's production gate is a compile-time const fn checked independently in both the parent and the detached child, so a compromised parent can't hand the child an override a release build would honor. Token fallback order matches the description exactly, and it travels over the child's stdin rather than argv or env, with the user's token explicitly removed from the child's environment before spawning.

Build, fmt, clippy, full suite (unit + the loopback integration tests) all pass. This is some of the most carefully verified privacy-surface code I've seen in this repo, nice work. Approving.