telemetry: implement deferred crash/cancellation/state-aware lifecycle instrumentation

[RamonArjona4]

📖 Description

Follow-up work implementing the telemetry issues deferred from the original
TraceLogging ETW PR (#493). Extends the experimental telemetry surface with
crash/panic, cancellation, and state-aware lifecycle instrumentation, and
tightens the non-zero-exit diagnostic contract, all behind the existing
--experimental + experimental.telemetry.enabled gate.

• Crash/panic telemetry (telemetry: emit crash/panic telemetry via a global panic hook #561): a global std::panic::set_hook handler
  (installed on both the one-shot and state-aware paths) emits a failure
  MXC.Execution + MXC.Error (internal_error, exit code 101) when any
  thread panics. No panic message or backtrace text is emitted — only the
  bounded category and exit code — and the previous hook is chained so the
  default stderr backtrace still prints.
• State-aware lifecycle instrumentation (telemetry: instrument the state-aware sandbox lifecycle #562): the provision/start/exec/
  stop/deprovision phases now emit telemetry carrying an mxc.phase field.
• Cancellation telemetry (telemetry: emit a cancellation event on Ctrl-C / console-close / shutdown #563): a console control handler (Ctrl-C /
  close / shutdown) emits a cancellation event before cleanup.
• Non-zero-exit diagnostic parity (Ensure MXC never exits non-zero without first printing an error message #564): audited the executors so a
  non-zero exit never occurs without first surfacing a diagnostic; extracted
  a shared emit_backend_error_envelope for lxc/darwin parity with wxc.
• Docs reconciliation (docs: reconcile docs/schema.md supported-version table with schema-version.json #565): aligned the docs/schema.md supported-version
  table with schemas/schema-version.json.

The change keeps the established PII invariant: free-form error text is never
emitted — only a bounded FailureReason/error_type enum and numeric exit
codes. On non-Windows platforms all telemetry functions compile as no-ops.

Includes review-driven hardening from adversarial + security + Copilot-style
reviews: the two telemetry-config parser paths were unified on the typed
experimental.telemetry field, a global-free crash-emit test seam was
extracted (making panic/cancellation mapping testable across any
backend/phase), and the state-aware parser now rejects a malformed
(non-object) experimental block consistently with the one-shot path.

Limitation (documented in docs/telemetry/telemetry.md): on backends that
recover panics via catch_unwind (the LXC runner), the panic hook records the
101 sentinel and claims the exactly-once terminal-emit slot, so the recovered
completion event is suppressed. There, mxc.exit_code = 101 is a
"panic occurred" marker rather than the observed process exit code.

🔗 References

Resolves#561
Resolves#562
Resolves#563
Resolves#564
Resolves#565

Related (deferred follow-up, not resolved here):

• telemetry: embed per-field descriptions in ETW metadata (TraceLoggingDescription equivalent) in our tracelogging wrappers #620 — embed per-field descriptions in ETW metadata (TraceLoggingDescription
  equivalent), deferred from the field-comment mechanism discussion.

🔍 Validation

Automated (from src/, toolchain 1.93):

• cargo fmt --all -- --check — clean
• cargo clippy --workspace --all-targets -- -D warnings — no warnings
• cargo test --workspace — all pass (adds panic/cancellation/state-aware
  telemetry unit tests, pure crash/state-aware event-planner tests, and
  state-aware parser tests including malformed/non-object experimental
  rejection)

CI gates run locally (all green):

• check-version-sync, check-schema-versions, check-rust-toolchain-sync
• check-schema-codegen + check-sdk-types-codegen (no wire-model drift)
• validate-configs (173 configs validated against the dev schema)

Reviews: 7-axis adversarial review (findings fixed), security review (clean),
and an emulated GitHub Copilot PR review (three findings fixed).

✅ Checklist

• Signed the Contributor License Agreement
• Linked to an issue
• Updated documentation (if applicable)
• Updated Copilot instructions (if build, architecture, or conventions changed) — n/a, no build/architecture/convention changes
• If this PR changes Cargo.lock, the dependency-feed-check check passes — n/a, Cargo.lock is unchanged

📋 Issue Type

• Bug fix
• Feature
• Task

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

Implements the remaining deferred experimental telemetry work across executors and the state-aware lifecycle, adding crash/panic and cancellation instrumentation while tightening the “non-zero exit must surface a diagnostic” contract.

Changes:

• Add lock-free “provider active” tracking and a new mxc.phase field to telemetry events.
• Add a shared crash/cancellation planning + exactly-once terminal emission guard, plus state-aware lifecycle telemetry emission with per-phase attribution.
• Factor and reuse emit_backend_error_envelope so all executors print a machine-readable diagnostic on infrastructure failures before exiting non-zero; update docs accordingly.

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/mxc_telemetry/src/lib.rs	Adds lock-free is_active() and threads phase through ETW event emission.
src/core/wxc/src/main.rs	Initializes/attributes telemetry on the state-aware path, installs panic hook, emits cancellation telemetry from console handler, and uses shared backend-error envelope emission.
src/core/wxc_common/src/telemetry/mod.rs	Adds panic/cancellation/state-aware telemetry plumbing, context attribution, and exactly-once terminal emission guard.
src/core/wxc_common/src/telemetry/events.rs	Extends event model with phase and updates error logging signature accordingly.
src/core/wxc_common/src/script_runner.rs	Introduces reusable emit_backend_error_envelope helper and basic unit coverage.
src/core/wxc_common/src/config_parser.rs	Rejects malformed non-object experimental in state-aware parsing; populates typed experimental.telemetry from raw state-aware block.
src/core/mxc_darwin/src/main.rs	Wires telemetry init/emit + panic hook and backend-error envelope emission for parity (no-op telemetry on macOS).
src/core/lxc/src/main.rs	Wires panic hook and backend-error envelope emission for parity.
docs/telemetry/telemetry.md	Documents state-aware phase telemetry plus crash/cancellation behavior and limitations.
docs/schema.md	Reconciles supported-version table with canonical schema version bounds.

[RamonArjona4]

Review round addressed — pushed as a single squashed update (9a7c722e)

All five outstanding review threads have been addressed. To keep the diff reviewable, the follow-up work was squashed into one commit (9a7c722e) on top of the commit you reviewed (c6a773ae) — it is content-identical to the incremental history.

Thread	Ask	How it was addressed
telemetry/mod.rs:493	"How do I correlate telemetry across phases for a given lifecycle?"	Added a per-lifecycle correlation field, then reworked it into a full Microsoft Correlation Vector (MS-CV) (correlation_vector.rs). Seeded at provision, relayed verbatim by the client into each later phase (emitted under __TlgCV__); the executor validates and spins/reseeds per phase. See the new "Correlating a lifecycle" section in docs/telemetry/telemetry.md.
telemetry/mod.rs:57	Exactly-once terminal-emit slot is untestable — HAS_EMITTED is a bare process-global with no reset.	Made the emit slot resettable + testable: added a #[cfg(test)] reset seam clearing HAS_EMITTED/PROCESS_BACKEND/PROCESS_PHASE, plus a test that claims the slot then asserts a second terminal emit is suppressed.
telemetry/mod.rs:353	The emit glue (emit_panic/emit_cancellation reading globals, guarding on is_active/already_emitted, writing to the hardcoded sink) has no capture point, so none of it is asserted.	Introduced a capture-sink / force-active seam over the mxc_telemetry::log_execution/log_error calls. Tests now activate emission, invoke emit_panic/emit_cancellation, and assert the captured MXC.Execution + MXC.Error carry the right backend/phase/exit-code (101 / 130).
wxc/main.rs:514	Cancellation "emit before cleanup" ordering is a real guarantee but nothing locks it in.	Added a handler-level test asserting emit-before-cleanup ordering (built on the sink seam above), so moving emit_cancellation() below the drain/cleanup now fails a test.
telemetry/mod.rs:692	Phase coverage incomplete — stop/deprovision untested, no success/guest-exit/dispatch-error matrix.	Added a table-driven plan_state_aware matrix over {provision, start, exec, stop, deprovision} × {success, non-zero guest exit, MxcError}.

Also in this update

• MS-CV hardening from an internal adversarial-review pass: tightened the SPIN_ENTROPY_BYTES compile-time guard (< 4, so the coarse-time counter still contributes to the 32-bit spun element), documented the deterministic os_random_bytes test seam, and corrected the frozen-vector pass-through wording across wire.rs / schema.md / SDK docs. Both codegen CI gates (dev schema + generated SDK wire types) pass.
• Backend error surfacing (Ensure MXC never exits non-zero without first printing an error message #564): shared emit_backend_error_envelope in wxc_common::script_runner so MXC never exits non-zero on an infrastructure failure without first printing a machine-readable {"error":{"code":"backend_error",…}} envelope on stderr — wired into all three executors and the state-aware finalize path, covered by a macOS seatbelt integration test plus unit tests. Flagging this explicitly since it is adjacent-but-distinct from the telemetry work; happy to split it into its own PR if you'd prefer.

cargo fmt/clippy clean; wxc_common + wxc tests green (446 + 25).