docs(002): re-baseline the telemetry spec for review round 2 of cdk-terrain #62

[so0k]

Re-baselines specledger/002-remove-hashicorp-telemetry to the state of cdk-terrain PR #62 after its second review round (2026-09-09). The code is the source of truth; every metric name and attribute set below was derived from packages/@cdktn/commons/src/telemetry.ts and its delivery-oracle tests.

What changed

• spec.md: FR-005 revised (the typed CdktfConfig.sendUsageTelemetry getter was removed; exactly one forgiving reader in commons), FR-012 (the Errors factories count cli.error{type, command} instead of posting), FR-014 (the canonical metric table with per-metric attributes and the once-per-failed-run rule for cli.command.error), FR-003 note for the ^10.73.0 pin. New FR-019 (binary, target and platform attributes from one lazy process-global probe), FR-020 (the restored per-stack and per-binding signal), FR-021 (enumerated and validated attributes, typed per-command allow-list, identity caps, SDK-stamped fields limited), FR-022 (single failure path, synchronous .fail, metric before the one bounded flush; absorbs cdk-terrain #378, fixes #360 and #361). SC-001 evidence re-grounded on the delivery oracle plus the CI E2E; SC-009 (E2E on every build) and SC-010 (LEAK-marker refutation) added. The HCL-output cli.stack.provider gap recorded as an edge case.
• research/2026-09-09-review-round-2.md (new): decisions R1 to R7, the five privacy findings and their fixes, the adversarial test-review verdicts, and the three internal edge-case tests kept with their WHY.
• research/2026-09-09-asset-pipeline-telemetry-evaluation.md (new): whether usage data could inform the asset-pipeline scope discussion (cdk-terrain #380). Verdict: very little; the one candidate metric is deferred, nothing is added to the library. research.md gets a pointer.
• contracts/telemetry-contract.md, data-model.md, quickstart.md, pr-migration-notes.md: synced to the code (payload allow-list, metric catalogue, single flush helper and failure-path contract, removal list, rewritten collected-data and never-sent lists, journeys updated for the CI script).

Known divergences left as written

• "Single emission point" for cli.command.error is not literal: two synth paths exit the process themselves and count their own failure; the spec says "once per failed run", which is what the code guarantees.
• FR-004's "7 call sites" is stale; the call-site map in data-model.md carries the current count.
• The June research decision to add a typed config getter stays in the history; its reversal is recorded in FR-005 and the new note rather than by rewriting the old decision.