Add a supported telemetry contract for reusable composite actions

[coderabbitai]

Summary

Define and implement a supported bounded-cardinality telemetry contract for reusable composite actions, starting with install-whitaker.

Rationale

.github/actions/install-whitaker/action.yml reports cache outcome, installation path, completion, and failure through GitHub ::notice and ::error annotations. These are logs, not metrics. The repository has no telemetry client, endpoint, credential model, or metrics transport.

A reusable action must not add an ad hoc client, external endpoint, credentials, or network egress. Such a change would create a security and portability requirement for every caller.

Scope

• Define the repository-supported telemetry sink and its authentication model.
• Define bounded labels for cache outcome, installation path, and failure category.
• Prohibit user-provided installer versions from metric labels.
• Add opt-in behaviour and no-credential behaviour for reusable actions.
• Integrate install-whitaker after the shared contract exists.
• Add unit and act-backed validation for metric emission and disabled telemetry.

Acceptance criteria

• A documented telemetry sink exists.
• Reusable actions can emit bounded metrics without caller-specific code.
• Metrics do not include installer versions, paths, secrets, or arbitrary input values as labels.
• The action continues to work when telemetry is disabled or credentials are absent.

Backlinks

• PR: Add install-whitaker shared action #361
• Requested by: @leynos