feat(spawn): identify the host integration to the spawned CLI

[luoxuanzao]

Summary

• Every CLI process the plugin spawns through the SDK now receives QODER_INTEGRATION_ID in its environment, injected in the shared spawn adapter next to the existing custom-provider opt-in.
• The CLI accepts an integration identifier only through that environment variable and reports it as the integration_id telemetry attribute; without it, SDK traffic from the plugin is unattributed. Only a UUIDv4 is accepted — any other value is silently dropped by the CLI.

Verification

• npm run typecheck
• npm run lint
• npm run test
• npm run build
• npm run release:check
• npm run audit:prod
• Tested affected qodercli behavior against a real CLI when applicable

Notes on the last item: the env injection itself was verified by bundling the spawn adapter and executing it in Node — the child process environment contains QODER_INTEGRATION_ID while the caller-provided env and the custom-provider opt-in are preserved. End-to-end telemetry receipt was not verified, as confirming the integration_id attribute server-side is out of reach locally.

Safety

• No credentials, private vault content, internal URLs, or personal paths are included
• User-visible changes are documented in CHANGELOG.md — not applicable: no user-visible behavior changes, so no entry (same as the previous SDK upgrade).