[rush reporter][R4] Harden reporter telemetry privacy projections #5977

Parent: #5858

Blocked by: #5976

Goal

Close the telemetry privacy follow-up identified during #5867 before reporter events are wired into uploaded Rush telemetry.

Context

Follow-up review: #5867 (comment)

TelemetrySubscriber.ingest() currently records producer package identities for every envelope, including local-sensitive extension events. Private plugin identities must not leak into uploaded telemetry.

Scope

• Collect producer identities only from public events, or introduce an explicit source-metadata allowlist/classification with equivalent protection.
• Review the full telemetry projection for fields derived from non-public envelopes.
• Add regression tests for public, local-sensitive, and secret events.

Acceptance criteria

• Local-sensitive and secret extension events cannot contribute producer package names/versions to uploaded telemetry.
• Public first-party producer/version aggregation remains intact.
• The projection remains allowlisted and deterministic.

DAG

Runs in parallel with the demo stream work; gates R8 and R9.

Part of #5858.