Add correlated MCP observability telemetry

[SHAREN]

Summary

Add bounded, correlated observability for CodexPro MCP requests, tool calls, and client sessions.

Changes

• correlate request/tool/session events with a redacted SHA-256 fingerprint derived from the OpenAI client session;
• record tool start, periodic heartbeat, and finish events with request/tool correlation;
• preserve redacted tool args and compact result summaries for diagnostics;
• expose authenticated read-only GET /telemetry/recent with bounded ring-buffer retention, since_seq, limit, and client-session filtering;
• use a 12-character session fingerprint consistently so external local diagnostics can correlate the same session without persisting raw session values;
• classify non-zero bash exits as telemetry status:"error" while leaving MCP transport behavior unchanged;
• add scripts/telemetry-smoke.mjs and include it in the standard smoke chain.

Validation

Passed locally on Windows:

• npm run build
• node scripts/telemetry-smoke.mjs
• git diff --check

The repository-wide Windows smoke suite is not fully green in this environment for pre-existing harness/setup reasons unrelated to this patch:

• bash-encoding-smoke requires native Git Bash;
• the self-test reports the same missing native Bash runtime;
• settings-smoke collides with the already-running local port 8787;
• http-smoke reaches its Windows child shutdown path and exits with unsettled top-level await;
• other existing doctor/handoff/release-guard Windows assumptions also fail independently.

No raw OpenAI session value is stored or returned by the new telemetry API.